ef8dc293e5
ProtonVPN does not NAT ICMP to external IPs (1.1.1.1, 8.8.8.8), causing the periodic small health check to always fail and restart the VPN loop. 10.2.0.1 (WireGuard gateway) responds to ICMP at ~28ms and remains reachable as long as the WireGuard tunnel itself is up.