I have a single app configured for vpn-protected access which initially works fine when used via openvpn with client app (i.e. curl) over both ipv4 and ipv6.

However that breaks reproducibly after each cloudron server/host reboot with nginx showing the custom 403 error page "VPN connection required".
It only break when client uses IPv6 but keeps working over IPv4.

Root cause

• docker container internal IPv6 are not stable but change after each reboot
• nginx allow lines on the vpn-protected app are unchanged
• so the new change ip's the traffic comes from get blocked by nginx

Note that only the IPv6 ip's change on reboot the IPv4 ones are stable across host reboots.
Because of this

• VPN access via IPv4 works
• normal app access (even without vpn) is unaffected with nginx proxy_pass lines using the internal IPv4 network

That problem applies to both blocks of 'access' which are added when activating vpn-proctection

• not just the source ip of the vpn container
• but also from inside the vpn-protected app container itself (when using curl to the external domain to force going via nginx and using curl -4 vs. curl -6)

Workaround

• Stop + start the vpn-protected app as that updates (or recreates) the applications nginx config pulling in the current/new IPs