Consider pushing block-ipv6 server-side

From openvpn man page:

       --block-ipv6
              On  the client, instead of sending IPv6 packets over the VPN tunnel, all IPv6 packets are answered with an ICMPv6 no route host message. On the server, all IPv6 packets from
              clients are answered with an ICMPv6 no route to host message. This options is intended for  cases  when  IPv6  should  be  blocked  and  other  options  are  not  available.
              --block-ipv6 will use the remote IPv6 as source address of the ICMPv6 packets if set, otherwise will use fe80::7 as source address.

              For  this  option to make sense you actually have to route traffic to the tun interface. The following example config block would send all IPv6 traffic to OpenVPN and answer
              all requests with no route to host, effectively blocking IPv6 (to avoid IPv6 connections from dual-stacked clients leaking around IPv4-only VPN services).

              Client config

                        --ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1
                        --redirect-gateway ipv6
                        --block-ipv6

              Server config
                     Push a "valid" ipv6 config to the client and block on the server

                        --push "ifconfig-ipv6 fd15:53b6:dead::2/64 fd15:53b6:dead::1"
                        --push "redirect-gateway ipv6"
                        --block-ipv6

              Note: this option does not influence traffic sent from the server towards the client (neither on the server nor on the client side).  This is not seen as necessary, as  such
              traffic can be most easily avoided by not configuring IPv6 on the server tun, or setting up a server-side firewall rule.