Ok, after a short break I returned to this problem and now have both a reason for the bad redirecting and also a cure. As indicated above there was indeed 'some network appliance' changing the URL.
I traced the problem by first adding some debug code into UrlRewriteModule.vb which quickly showed that Request.Url was not returning the URL that I originally entered. A similar test with a separate ASP.NET page confirmed that was the case independently of DNN. I was then able to take this information to our sys admin who introduced me to the department's Microsoft ISA Server 2004 (now this is all new to me).
What we discovered together was that there is an innocent looking checkbox on the "Publish <whatever> HTTP Properties" dialog called "Forward the original host header instead of the actual one". This is NOT checked by default. However, without it all request appear to be addressed to the <internal>.<domain> named server. And that's teh case even if an IP address was originally used.
So with that checkbox checked I then went on to add all of the following aliases to my PortalAlias table, making sure that the first one is the <external> and therefore always accessible one.
<internal>/dnn
<external>/dnn
<internal>.<domain>/dnn
<external>.<domain>/dnn
<internal IP>/dnn
<external IP>/dnn
And now everything works exactly like it should.
Thanks for all the help given, Keith