Well, well, well. Apparently, Arch Linux is set up by default to refuse all incoming conections. /etc/hosts.deny contains the one line (besides comments) ALL: ALL: DENY, and /etc/hosts.allow is empty. It is nice, upon learning what these files do, to find such a paranoid default.