See above. In particular I have:

interface ppp+ internet src not "${UNROUTABLE_IPS}"

        policy drop
        protection strong

        server ident reject with tcp-reset
        server ICMP accept
        server custom cvpn-ka udp/21212 default accept
        server ssh accept

        client all accept

With policy drop, I'd expect "connection timed out" rather than connection refused. So I can only assume that this section isn't being considered applicable for some reason.