Like I said, scrap that.
I figured it out.
It turns out that you can not allow Cloudflare to proxy your discourse subdomain - you have to click the orange cloud on the subdomain A record to grey for DNS only – and then your discourse installation should have no problem accessing the appropriate ports.
Thanks!