I've sorted it! Turns out it was something obscure in how Norton handles rules - if you set it to "to and from" then both ends have to match the rule (in this case, the packet had to be from 10052 to 10052). It doesn't help that that's only explained in a irrevelant part of the help file (the part that tells you what order the rules are processed in). I hate Norton.