Nacsiar - thanks for your reply.

My client was failing to connect because of a firewall issue, and I thought the problem was with bitcoind because netstat wasn't showing it listenting on IPv4 port 8332.
It turns out that bitcoind was listening on a joint IPv4/6 socket on port 8332, it was just that netstat shows this joint socket as tcp6.

If you don't set rpcallowip then separate IPv4 and IPv6 ports are opened (as you have shown).

If you set rpcallowip (e.g. rpcallowip=*) then a single joint IPv4/6 port is opened. This works fine, but netstat shows it as tcp6 only, and the difference in behaviour confused me.

I've got my client/server working now without any changes to bitcoind.