I want to post a closing comment to my ridiculous saga.
I spent quite a bit of time this afternoon with Brandon - trying all sorts of interesting router and pap2/server configurations.
I even set up my 'old' WRT54GS as the internet router, and hung the PAP2 off it, taking the WRT610N out of the picture.
The behavior was identical.
I ended up flashing the 54GS to DD-WRT.
And.....
IT JUST FREAKIN' WORKS
No port forwarding
No port triggering
No DMZ
No nothing
As basic a router config as you can get.
It just works.
Somebody needs to take whoever is responsible for the NAT section of the LINKSYS firmware, and put him in a room with a couple dozen recalcitrant Linksys routers and PAP2s. Tell him/her they can come out when they just work properly all the time.
Many thanks to Brandon, and Tim - for their dedication and patience.
Now to compose a nastygram for the President of Cisco......

Bookmarks