Okay, figured out what I was doing wrong. What I was seeing was not the self IP of the LTM, but the connection from the GTM health monitor. What I wasn't seeing was the external connection, and that was because it wasn't getting there (firewall issue upchannel from my F5). Now that the firewall issue's been resolved, I can see the external IPs connecting, which means I can move on to setting the restrictions.
Once you guys pointed out that the iRule at least should have been right, and that the snat takes place after the CLIENT_ACCEPTED event, I could figure out where to look for the problem.
Nimbostratus