Ah. After further prodding, sion_a says a) we don't have the ip_portfw kernel module, and b) it might be time for a kernel upgrade...

Thanks for your help anyway, hopefully we'll be able to use your magic runes when the, um, *waves hands* innards are sorted out. :-)