script de roteamento openvpn falha quando executado a partir de systemctl

Question

Eu tenho um conjunto de programas que devem ser executados através de VPN e não devem ter acesso à Internet quando a VPN não estiver conectada no Arch Linux. Eu faço isso criando um namespace de rede que contenha a interface de rede VPN como a única maneira de acessar a Internet e executar esses processos nesse namespace de rede.

O problema que estou enfrentando é que, embora funcione bem, se eu executar openvpn como root, mas não funcionar se eu executar o systemctl .

Configuração do OpenVPN:

client
route-noexec
script-security 2
dev tun42
proto udp
remote <remotehost> <remoteport>
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/client/ca.crt
tls-client
remote-cert-tls server
auth-user-pass /etc/openvpn/client/vpn-creds
comp-lzo
verb 1
reneg-sec 0
crl-verify /etc/openvpn/client/crl.pem
route-up /etc/openvpn/client/route-up.sh

route-up.sh:

#!/bin/bash
/bin/whoami

NS=ns

if [ ! -f /var/run/netns/$NS ]; then
    /sbin/ip netns add $NS
fi

/sbin/ip link set $dev netns $NS
/sbin/ip netns exec $NS /sbin/ifconfig lo up
/sbin/ip netns exec $NS /sbin/ifconfig $dev $ifconfig_local pointopoint $ifconfig_remote up
/sbin/ip netns exec $NS /sbin/route add default gw $ifconfig_remote metric 1024

A saída de systemctl status openvpn-clien@vpn depois de tentar start it:

Feb 18 11:57:22 arch openvpn[5216]: root
Feb 18 11:57:22 arch openvpn[5216]: mount --make-shared /var/run/netns failed: Operation not permitted
Feb 18 11:57:22 arch openvpn[5216]: Error: argument "ns" is wrong: Invalid "netns" value
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: Cannot open network namespace "ns": No such file or directory
Feb 18 11:57:22 arch openvpn[5216]: WARNING: Failed running command (--route-up): external program exited with error status: 1
Feb 18 11:57:22 arch openvpn[5216]: Initialization Sequence Completed

O mesmo comportamento exibido independentemente de ter sido executado manualmente ou automaticamente na inicialização do sistema, se eu ativar o serviço.

systemctl cat [email protected] output:

# /usr/lib/systemd/system/[email protected]
[Unit]
Description=OpenVPN tunnel for %I
After=syslog.target network-online.target
Wants=network-online.target
Documentation=man:openvpn(8)
Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO

[Service]
Type=notify
PrivateTmp=true
WorkingDirectory=/etc/openvpn/client
ExecStart=/usr/bin/openvpn --suppress-timestamps --nobind --config %i.conf
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE
LimitNPROC=10
DeviceAllow=/dev/null rw
DeviceAllow=/dev/net/tun rw
ProtectSystem=true
ProtectHome=true
KillMode=process

[Install]
WantedBy=multi-user.target

Como faço para configurar corretamente o namespace de rede quando executado através de systemctl ?