samba - Mar 2003 - Help! Can browse from one subnet but not another.

I'm having some difficulties setting up browsing across networks and domains
and was hoping some of you folks out there could help.

We have two domains on two physically separate networks, connected via a
firewall/router. To my knowledge the firewall system is not set to block
anything between the two segments, just to route them.

Network 192.168.18.0, CH domain
 192.168.18.14 ch1 (rh7.3, CH domain controller, wins server)
 192.168.18.15 ch2 (w2k, app server, set ch1 for wins manually)
 192.168.18.18 mtoal (w2k, my computer, set ch1 for wins manually)

Network 192.168.20.0, PW domain
 192.168.20.8 pw1 (rh7.3, samba, PW domain controller)
 192.168.20.5 pw2 (w2k, app server, set ch1 for wins manually)
 192.168.20.61 streetsmary (w2k, example machine, ch1 for wins via dhcp)

ch1 is set up as the WINS server for the whole WAN:
 netbios name = ch1
 workgroup = ch
 os level = 64
 preferred master = yes
 domain master = yes
 local master = yes 
 wins support = yes
 remote announce = 192.168.18.255 192.168.20.255
 remote browse sync = 192.168.18.255 192.168.20.255
 name resolve order = wins lmhosts

pw1 is set up to use ch1 as it's WINS server, and is
set up to be the local master browser on its subnet:
 netbios name = pw1
 workgroup = pw
 domain master = no
 local master = yes
 preferred master = yes
 os level = 64
 wins support = no
 wins server = 192.168.18.14
 name resolve order = wins lmhosts

I can be at machine mtoal and I can browse the CH workgroup in network
neighborhood just fine. I can also browse to \\pw1 and \\pw2 in network
neighborhood if I type in their names in the address bar, but the PW workgroup
does not appear by itself. I can browse to the machine streetsmary from my
machine but only if I type in the ip number: \\192.168.20.61

The situation from machine ch2 is the same.

Now, at the PW network, I can control pw2 via VNC. I can readily see both the PW
and CH workgroups in network neighborhood. I can  browse into shares on any
machine in either workgroup.

I call Mary who is using the machine streetsmary at PW and she can not see any
evidence of the CH network. When she goes to ch1 via IP by typing
\\192.168.18.14, she is prompted for a password which is expected since she is
not an admin.

So, the big question:

Why can I see both networks from machine pw2 when I can NOT see them from either
ch2 or mtoal (my machine)???

Of course, I would like to be able to get the full browse list on any machine on
either network.

Does each network need it's own WINS server since they are in different
domains? Then we use remote browse sync and/or remote announce to get them to
talk to each other?

I've spent a couple days on this now and I'd really appreciate some
advice. Thanks!

mtoal