I think I just figured this out myself.  The crux is that a service specified in a NAT rule has to be a UDP or TCP service, not something altogether different.  This solution may not be possible at all before 8.3, but this is what I'm in the middle o...