Firewall – Endian Community: How to correct PURPLE_DEVICE in /var/efw/openvpn/settings permanently

Dear serverfault community,

I am currently migrating a "normal" IPTABLES firewall with an OpenVPN server to a new box containing Endian Community Firewall 2.5.1.

The new Endian firewall contains an OpenVPN server; however, I can not use the new server with those settings since the VPN users have special requirements.

Therefore I replaced the VPN server configuration on the Endian box (and also the template for the VPN configuration file).

The issue is that I have to use tun0 as a device, not tap0. Endian doesn't support tun0 naturally and somehow uses tap0 as the VPN device.

This leads to IPTABLES rules which only apply to tap devices.
I therefore had to apply some IPTABLES rules manually in order to get OpenVPN with the old configuration and tun0 device working.

When I reboot my new Endian box, those rules are overwritten again (tap0 instead of tun0).
I tracked down why these IPTABLES rules are generated with tap0:
/var/efw/openvpn/settings
-> PURPLE_DEVICE=tap0

Endian uses this file to generate the IPTABLES rules. When I change the value for PURPLE_DEVICE to tun0 and regenrate the IPTABLES rules it all works.
Unfortunately a reboot of the Endian box overwrites the settings file and I did not find out how I can prevent Endian from doing so.

So – how can I change the settings file permanently so it always contains PURPLE_DEVICE= tun0?

I already edited /usr/lib/efw/openvpn/default/settings, but unfortunately this seems not to have any effect at all.

I can't set an immutable bit on this file since Endian doesn't support it.