No NAT with embedded-1.32.img - Why?

I'm new here, but not in networking.

I have set the following on my Soekris 4801:

WAN interface:
Status up
172.20.16.207/255.255.255.0
Gateway 172.20.16.1

I can ping the outside from the serial console, including FQDNs; so 
there is name resolution.
Media is 100baseTX <full-duplex>

LAN interface:
Status up
10.10.42.1/255.255.255.0

I can use the webGUI from the LAN, so everything should be okay: reach 
m0n0wall from the inside, and reach the outside from m0nowall.

But: No way to get to the outside from the LAN, everything times out, 
ping, http, imap ... .

I have tried all, including unblocking 'private networks'.
I don't think I have to do any settings for NAT, I only want outgoing?

I rebooted  a few times, including setting the outside to DHCP, and 
everything is the same: all sides work independently, but no outgoing 
traffic at all. The automatic NAT rule is
WAN 10.10.42.0/24 * *
and looks good to me.

Is this a bug? I ask, because I seem to be in good company:
http://forum.m0n0.ch/index.php/topic,3968.0.html
"After numerous reboots it just seemed to start working!" seems a bad 
way to debug this problem.

I have tried with 'Advanced outbound NAT' on and off, with proxy-ARP 
because of becoming desperate; did a factory reset on the serial 
console, and setting everything again (DHCP, see above).
No success.

Any hint appreciated,

Uwe