before it happened regulary that locally generated ICMP messages left eth0 with wrong source address instead of going out via the vpn interface