Is Blowfish strong enough for VPN encryption? I'm looking at an OpenVPN connection between two sites configured to use 128 bit Blowfish in CBC mode, and trying to figure out how to assess the strength, but I just don't know enough of the maths.

I could ask this over on Sec.SE, but there I think the focus might be on whether it should use 3DES instead of Blowfish – here I guess I'm hoping for guidance as to relative strength of the algorithm, and whether a break is realistic when used this way.
Thomas mentioned some "theoretical weaknesses" that can happen with $2^{32}$ blocks of data with CBC mode and an 8 byte block cipher; I will explore more about what that weakness is, and its practical relevance.

In CBC mode, we effectively send randomized data through the block cipher.  However, there is a chance that it happens to encrypt the exact same data twice with the same key; this results in the exact same ciphertext block appearing in the encrypted output twice.  If an attacker finds this, then he can deduce the exclusive or of the corresponding plaintext blocks.

How likely is this to happen?  Well, after about $2^{32}$ blocks of data ($2^{35} = 34$ Gigabytes of data), the expected number of times for it to happen is about 1 (it might not happen at all, or it might happen 2 or 3 times); if you encrypt more data, it's expected to happen more often; if you encrypt less, it can still happen (but with a reduced probability of happening).

How much effort will an attacker have to go through to find those colliding pairs?  Well, not very much; the biggest difficulty that the attacker would have is just dealing with the multigigabytes of data, and that's quite feasible for a determined attacker.

How much is this information leakage a security concern?  Well, that depends entirely on the nature of the plaintext.  The attacker will see the exclusive or of pairs of 8 byte segments, however he has no control over where they might appear.  8 bytes might be enough for him to guess the underlying plaintexts (and then, it might not), and even if he did, we might not care if he can deduce 16 bytes of data out of 34 Gigabytes.  On the other hand, maybe we do care -- that's really up to the application.

Now, block ciphers with 16 byte blocks (such as AES and Twofish) don't have these concerns (this same weakness can be expected to take place after $2^{68}$ bytes of encrypted data; we will never need to encrypt that much data with a single key).  This is one of the reasons we advise people to use more modern ciphers; this observation might not be a concern for a particular user, but with a modern cipher, we know it's not a concern for anyone.