Now I’ve found out that when I comment out the require-mschapv2 and mppe required,no40,no56,stateless config options, I can connect using CHAP protocol, but not MS-CHAPv2. So it is definitely not a firewall/bad credentials issue.
On the other hand, I can normally connect with MS-CHAPv2 auth to a Raspbian VPN server, so the client side is also okay.
Unfortunately, I can’t just copy/paste the working config from the Raspi, because it has different/incompatible versions of pppd (2.4.5, but with different config options syntax).