Seu problema é o Type=simple na descrição do serviço VPN. O Wiki do Arch esclarece o página de manual , um pouco:
Type=simple(default):systemdconsiders the service to be started up immediately. The process must not fork. Do not use this type if other services need to be ordered on this service, unless it is socket activated.
Você provavelmente pode fazer isso funcionar alterando o tipo:
Type=oneshot: this is useful for scripts that do a single job and then exit. You may want to setRemainAfterExit=yesas well so thatsystemdstill considers the service as active after the process has exited.