FWIW, the screenshot shows both NAT Mapping and NAT keep-alive disabled.
Changing those to Yes (enabled) was what fixed my problem...