The problem is not your listener it is your firewall. You are probably doing NAT (Network Address Translation). The Connect packet gets to the listener, but with a response to talk to a port (and maybe address) different from the x.x.x.x:1521 that initiates the transaction(s). The port change is part of SQL*NET, with the address translation a standard part of firewalling (with a proxy server maybe?)

You need to look at ConnectionManager (part of the Oracle software suite) to sit in your DMZ with the firewall and have the Oracle connections pass through it. Oracle 8i required CMAN to handle NAT.