I think the issue with this (@tasket’s) vpn access using debian-12 is an ongoing issue. I’ve had the problem ever since I started moving stuff to 12. 11 still works fine, and I have that in place still. And the issue seems to be nft related, which is why I thought your patch may have worked in 4.1.
Just out of interest, your --install process never put the proxy-firewall-restrict script in the /rw/config area at all. Other files that were in the old debian-11 install were also missing.