systemd-only-kill-process.conf

[Service]
#
# netfilter_openvpn.sh forks off netfilter_openvpn.py in order to delete
# iptables/ipset rules as the process shuts down.  systemd.kill(5) in its
# default KillMode=control-group will kill those forks before they have a
# chance to do their work.  Rather than un-fork them and potentially create
# runtime issues, we pay the penalty at shutdown time.
#
# There is a slight risk that you could blow out TimeoutStopSec from
# systemd.service(5), but the CentOS default is around 90s.  If you exceed
# that, you may leave iptables orphans, but you probably have bigger
# issues on the server at that point.
#
KillMode=process