How can i migrate my vpn-scripts from f38(iptables) f39(nftables)?

[apparatus]

Those are not scripts created by me, they are used in the guide in that link.
That guide assumes that you will run openvpn process with qvpn group permissions:

@taradiddles

#!/bin/bash
VPN_CLIENT='openvpn'
VPN_OPTIONS='--cd /rw/config/vpn/ --config openvpn-client.ovpn --daemon'

groupadd -rf qvpn ; sleep 2s
sg qvpn -c "$VPN_CLIENT $VPN_OPTIONS"
su - -c 'notify-send "$(hostname): Starting $VPN_CLIENT..." --icon=network-idle' user

So the firewall rules in the script are restricting the outbound traffic and only allow the traffic originated from the processes started by qvpn group.

Since you use different group name in your script then change qvpn to matrix or vice versa.
And start the openvpn process from this group and not like this:

@smlt

sudo openvpn --cd /rw/config/vpn --config openvpn-client.ovpn