VPN traffic over tun0 only works when DEFAULT_GATEWAY: 'false' environment variable is not set

[nft2]

Steps to reproduce:

Building (in docker-compose) without DEFAULT_GATEWAY: 'false' (intended behavior):

> curl ifconfig.me will return the VPN's IP address, and curl --interface eth0 ifconfig.me will return the server's real public IP address.

Building (in docker-compose) with DEFAULT_GATEWAY: 'false':

> curl ifconfig.me will return the server's real public IP address. However, curl --interface tun0 ifconfig.me will time out.

What I'm trying to do is have the server setup only to route traffic through the VPN if the tun0 interface is used. My intention is to write a Python script that controls which source adapter is used (I have done this before with "real" network interfaces). However, the default route needs to be non-VPN.

I'm not sure if this is unintended behavior or not, but any guidance you could provide on how best to do this would be much appreciated.