You’re welcome!
I don’t know the answer and I don’t have a VPN using OpenVPN for running tests. It usually means that the running NM GUI does not have enough permissions to write config files.
However, reading through the nmcli man pages, I noticed that you cannot have the “connection.autoconnect” property enabled on a “vpn” connection (note that “wireguard” is a distinct connection type, different from “vpn”, and it supports autoconnect).
There is another suggested way to achieve this, using “secondaries”. This has to be applied to eth0, and then as soon as eth0 is started, the secondaries (specified by connection UUID) are also started.
This sounds like the solution you’re looking for (the rc.local being a workaround).
EDIT:
Ok, now I think I know how to reach the “solution”.
Step 1. Get the UUID of your VPN connection:
nmcli c show
Step 2. Edit eth0 using the interactive editor (as root)
nmcli connection edit type ethernet con-name eth0
nmcli> goto connection.secondaries
nmcli> set UUID-of-VPN-connection
nmcli> b
nmcli> print
nmcli> save
nmcli> quit
Note that I don’t have my Qubes 4.3.0 laptop and NetworkManager may be slightly different in debian 13. You can get help in the nmcli editor by typing “help” and “desc” to troubleshoot if the commands I wrote don’t work for you as they are.
EDIT2: should work, the commands work for me on debian-13!