Hook name is route-pre-down, not route-down.

bin/setup-vpn.sh

@@ -230,7 +230,7 @@ ns-cert-type server
 comp-lzo
 verb 3
 route-up "/etc/openvpn/$node-route-up.sh"
-route-down "/etc/openvpn/$node-route-down.sh"
+route-pre-down "/etc/openvpn/$node-route-pre-down.sh"
 EOF
     #
     # Note that because we have to pack multiple aggregates onto ctlnuc
@@ -263,7 +263,7 @@ ifconfig br\$VTAG $agg_gw netmask $agg_mask up
 ip route add $agg_cidr dev br\$VTAG table $aggprefix
 EOF
     chmod 755 /etc/openvpn/clients/$node-route-up.sh
-    cat <<EOF > /etc/openvpn/clients/$node-route-down.sh
+    cat <<EOF > /etc/openvpn/clients/$node-route-pre-down.sh
 #!/bin/sh
 
 VNODES=\`/usr/local/etc/emulab/tmcc vnodelist | sed -nre 's/^VNODEID=(pcvm[0-9]*-[0-9]*) .*$/\1/p' | xargs\`
@@ -283,7 +283,7 @@ ip rule del iif tun-$aggprefix to $agg_cidr table $aggprefix
 ip route flush table $aggprefix
 ifconfig br\$VTAG 0 up
 EOF
-    chmod 755 /etc/openvpn/clients/$node-route-down.sh
+    chmod 755 /etc/openvpn/clients/$node-route-pre-down.sh
 
     #
     # Ok, copy the key/crts/conf files to the agg host