Tell ansible to not ssh over the vpn (before its up).
I think this is a typo.
Yes.  It was a typo.