I've found a workaround: enabling and disabling "Network Link Conditioner" seems to overwrite any legacy network settings that might have prevented the tunnel from being established.