VPN in container requires tun/tap device – if you don’t have one you have to create it with mknod command. But, there is the problem – in the LXC (Proxmox) unprivileged container is mknod (as syscall) not allowed, because this would introduce possible security problems (see this article).