extensi0n, I think you've nailed it. I had it set "External Only" but after changing to "Automatic" everything's working. And looking at /tmp/etc/openvpn/fw/server1-fw.sh it appears that that setting controls how iptables is configured for forwarding. Cool. Thanks a lot!