Gateway bridge fails when connected through tunnel


I have an issue with a concentrator - to - gateway bridge connection. I am running the concentrator (a RAK2287) on a Raspberry Pi, with UDP link to a Chirpstack gateway bridge, network server, and application server running on another machine.

When I allow a direct UDP connection on Port 1700 from gateway to Chirpstack server, everything works fine (end devices do an OTAA join request, server accepts, and bidirectional communication ensues.) However, my topology requires that the UDP connection be carried through a tunnel in production. In this case, I see the join request at the server, but never issuance of an accept.

I have simplified the issue by creating a very simple UDP forwarder on the gateway which listens at localhost:1700 and forwards to server:1700, and also forwards UDP packets from the server back to the lora_pkt_fwd daemon on the gateway. With this forwarder in place, the problem is recreated: I see join requests at the server, but never an accept reply.

Can anyone suggest a reason why this might happen?

Thank you!