That was a totally stupid error. The NETGEAR FVS338 web interface has separate entries for TCP and UDP when mapping ports. My TCP rule was correctly mapping TCP traffic, but my UDP rule was mapping TCP also. I feel ashamed. -- Jeff