redirect/dnat to localhost address in prerouting chain?

I have a multi-homed host that (among a lot of other things) routes
traffic between the different subnets in my home network.  On that host
I have a couple of *redirect* rules in a prerouting chain:

table ip nat {

   chain prerouting {
     type nat hook prerouting priority dstnat + 20
     policy accept

     # HTTPS connections to old switches are redirected to stunnel
     ip daddr { ... } tcp dport 443 redirect to :8084

     # HTTP connections to the management network are redirected to an
     # Apache virtual host that will send a redirect to the HTTPS version
     ip daddr .../24 tcp dport 80 redirect to :8089
   }
}

In order to make this work, I currently have both stunnel and Apache
listening on the IPv4 wildcard address, which I don't like.  There's no
reason that stunnel or Apache (on that port) should ever receive traffic
directly from another host.

Unfortunately, I haven't been able to make things work when stunnel or
Apache is configured to only listen on 127.0.0.1.  The redirect rules
shown above result in a "connection refused" error.  I've also tried
changing the rules from redirects to dnats, e.g.:

   redirect to :8084 → dnat to 127.0.0.1:8084

This causes connection attempts to time out.

Is there any way to make this work?

TIA!

-- 
========================================================================
If your user interface is intuitive in retrospect ... it isn't intuitive
========================================================================