Disable the firewall on each machine. If it works then you know the issue straight away. If not, keep guessing!

Oh sorry, forgot to say I did that earlier and it didn't help.

Thinking maybe it's a port thing with the router? What's the easiest way to rule that out?

Our phones (one Android, one iPhone 3G) were able to connect to each other with the mobile edition (free demo; not giving Notch £5 for it!), over the same wifi network.

Got it working with Hamachi.

Of course, since we've only got my account, only one of us can be logged in at one time .... until I put the server in offline mode, and my brother plays offline, and now it looks like we can both play together.

Yay Hamachi. :)

your problems (without Hamachi) most likely stem from the way minecraft authenticates accounts, you and your brother will both have the same external IP - I believe the official MC server software will only allow one connection per IP address

That causes a "bad login" error, not a timeout?

could be, for me the errors seem to be randomly generated, get different ones all the time on Ant's server