According the OpenVPN 2 Cookbook:
The persist-tun and persist-key options are used to ensure that the connection comes back up automatically if the underlying network is disrupted. These options are necessary when using user nobody and group nobody (or group nogroup).
What does this mean in the practice?
On the server side there is a tun0 device. The OpenVPN process runs as nobody and nogroup. So far it's okay. But what exactly does persist-tun option do? Depending on whether or not I connect, the same tun0 device is still there.
From an another question:
Get rid of the persist-tun option. Without that option, then the VPN link goes down, the tun device will close and be removed. The problem of course is that removing that option means that you need to run your VPN daemon as root instead of nobody. Because as nobody account, OpenVPN will not be able to create a new tun device when the connection is re-established.
After removing the persist-tun option the tun device is still there without a connected client.
Somebody please explain in detail the process in which persist-tun, persist-key, user nobody, group nogroup and keepalive options are involved.