Where are my inbound UDP packets ending up?

I have a shiny compute-engine instance running COS, with a docker container using host networking, listening on a particular UDP port.  It has an external ipv4 address on the default nic - it's an ephemeral address and it doesn't show up in ipconfig, but I couldn't determine from the documentation if there was any reason UDP packets shouldn't go through.

I've added firewall rules to allow UDP traffic on that particular port on the instance's service account, and the cloud logging indicates that these rules are being matched.

If I use nc from the COS toolbox on the instance, I see a message in my application's log.  But from elsewhere, it looks like my packets don't get through.  What else might I need to configure to get packets on the external ip address coming through to my instance?