ufw not enabled on boot
In case anyone else has similar problems, here is my solution.
After a great deal more research and hackery, found that the file
/etc/init.d/firewall
was running lots of 'iptables' commands, setting up rules which overwrote anything that ufw had put in. Added this line to that file, at the end of the 'start' section:
/etc/init.d/firewall-local-rules
which is a link to a script that runs my ufw setup commands.