During the night, amprgw fetched a copy of the encap
file from the portal
which was truncated (it had 259 entries instead of over 600) and one of
the entries that was in the copy fetched had no gateway address. Viz:
route addprivate 44.131.168.128/29 encap
This caused the ipip daemon to segfault and so there
was no routing
between Internet and tunnel subnets for an hour.
For this particular issue it would help when the encap file had a trailer that
the script that fetches it could check for before loading it. Something like:
# EOF
Rob