As an experiment, I made a copy of an old WinXP virtual machine and installed TwinCat2 on it. It came with a sample PLC program, which I got to run by following a tutorial on Beckhoff's website. I then pointed my VS project at the new XP VM and got it to display a blinking light based on one of the variables inside the Beckhoff software. I also found a static route called AdvancedHMI8BE1 in the system control dialog box and in the system manager under System - configuration -> Route settings.
The only trouble I had was that there was a second host-only network adapter on the virtual machine. While that was there, Wireshark was showing traffic on the second adapter and AHMI wouldn't work. Once I deleted the second host-only adapter, AHMI started working. Is there a trick on the Beckhoff side when there are multiple NICs? The Beckhoff PC I'm trying to connect to has 2 NICs. I'm using one of them for these tests but it'll ultimately have to talk through the other that's connected to our wired LAN.
I also asked the OEM if there is a setting on their end that's blocking it. Hopefully there is and they're willing to tell me how to un-block it without paying them for their (very expensive) software.
It looks like the AHMI side is configured properly and that there's something wonky inside the Beckhoff PC.