I've got nearly all of the previous firewall's capabilities back by disabling the rc.firewall and loading the settings in a script I had been using previously (it's Version N-1 but close enough for now). I'll redo rc.firewall to invoke it -- or a subset of it -- at startup.

Gonna call this one solved. Shees, the wild goose chase one can get involved in when having bad information on the ISP equipment. (I went into the "advanced configuration" section of the router's web interface and there's nothing that corresponds to the information I got from that one helpful technician.)

Thanks for all the tips from responders. Much appreciated.