Interesting, I had always assumed that the reason that script and the service script were split was because the Node called the script directly.  However, looking at the code I see the runtime calls oo-iptables-port-proxy instead.