The scenario with a critical connection fault typically means either there is a firewall in the way or you are perhaps behind a NAT router or some other form of Internet connection sharing. Network Address Translation means that you have many machines with private IP addresses all sharing one incoming "real" IP address.
I'll give more detail about the client side since I'm very familiar with it. I may be able to provide more server (desktop) side details in a day or two, but don't hold me to that
On the client side, the firewall must be configured to allow port 990 to come in and be routed to your PocketPC. This can just be opening a port on a firewall, or in the case of NAT you must tell the router what internal address should handle this request. You have to either statically set your IP on the PocketPC or, if your router handles it you can set up a "special application".
I have worked with DLink DI-713p and DI-614+ routers and they are very similar for setting up "special applications". The idea is to figure out an outgoing trigger port, and when that outgoing trigger is used open up an incoming port to that IP address. There are two nice things about this approach: The incoming port isn't open when not being used and you don't have to statically tie the incoming port to one IP address (more than one PocketPC can use activesync, though probably not at the same time).
For clients it works to set the trigger port to 5679 and the incoming public port to 990. If you can't use trigger ports then you'll have to tie the incoming 990 port to the static IP you'll always assign to your PocketPC.
As far Activesync on the desktop side goes, I know the trigger approach won't work. This is because the request for ActiveSync is originated by the PocketPC and there is no trigger before that request to open the incoming port. So you must either have a non-NAT address or be able to configure the incoming ports to be forwarded to your private IP address. The incoming ports are one or more of 999,5678 and 5679 (I will try to do some testing or talk to the firewall guy at work to see if I can narrow this down a bit - I've always meant to).
If you area already non-NAT on the desktop side and still having trouble then it is likely a firewall issue needing to open the same ports.
Hope that all makes enough sense to be useful.
NAT & router configuration
Linear Mode
