CODE CHANGE:
add following code to sock.c starting at line 113

mark=3;
if ( setsockopt(sockfd, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) ){
  int ver=errno;
  log_message(LOG_INFO, "could not mark with %d because: %s", mark, strerror(ver) );
}


UNIT FILES AND SCRIPTS

/lib/systemd/system/[email protected]

[Unit]
Description=OpenVPN connection to %i
PartOf=openvpn.service
ReloadPropagatedFrom=openvpn.service

[Service]
Type=forking
ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --config /etc/openvpn/%i.ovpn --tls-exit --down "/etc/openvpn/down.sh %i" --up "/etc/openvpn/up.sh %i" --script-security 2 --route-noexec
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/openvpn
Restart=no

[Install]
WantedBy=multi-user.target


---------------

/etc/openvpn/up.sh

#!/bin/sh
#up sh
NAME=$1
DEV=$2
LOCALIP=$5
GATEWAY=$route_vpn_gateway
AC=$(echo $DEV | sed 's/tun//')
PT=$(($AC+3129))
TB=$(($AC+100))
FWM=$((AC+3))



cat <<EOF > /tmp/tinyproxy-$1.conf
DisableViaHeader Yes
User nobody
Group nogroup
Port $PT
PidFile "/tmp/tinyproxy-$1.pid"
Logfile "/tmp/tinyproxy-$1.log"
ConnectPort 443
ConnectPort 563
ConnectPort 80
StartServers 10
LogLevel Info
Timeout 600
Allow 127.0.0.1
Anonymous "Host"
Anonymous "Authorization"
Anonymous "Cookie"
MaxClients 10
Bind $LOCALIP
LogLevel Info

EOF

touch /tmp/tinyproxy-$1.pid
touch /tmp/tinyproxy-$1.log
touch /tmp/tinyproxy-$1-test.sh
chown nobody:nogroup /tmp/tinyproxy-$1.pid
chown nobody:nogroup /tmp/tinyproxy-$1.log
chown nobody:nogroup /tmp/tinyproxy-$1.conf
chown nobody:nogroup /tmp/tinyproxy-$1-test.sh
chmod 777 /tmp/tinyproxy-$1-test.sh

cat <<EOF > /tmp/tinyproxy-$1-test.sh
#!/bin/sh
logger "var is $DEV"
ip route add $GATEWAY dev $DEV
while ! fping -c 1 -q -t 1000 $GATEWAY ; do
        ip route add $GATEWAY dev $DEV
        sleep 1
        logger "waiting... $GATEWAY"
done

iptables -A OUTPUT -o $DEV -j ACCEPT
ip rule add from $LOCALIP fwmark $FWM table $TB
ip route add default via $GATEWAY dev $DEV table $TB
ip route flush cache
echo $?
EOF


---------------

/etc/openvpn/down.sh

#!/bin/sh
NAME=$1
DEV=$2
LOCALIP=$5
GATEWAY=$6
AC=$(echo $DEV | sed 's/tun//')
PT=$(($AC+3129))
TB=$(($AC+100))
FWM=$((AC+3))
systemctl stop tinyproxy@$NAME
rm -f /tmp/tinyproxy-$1.conf
rm -f /tmp/tinyproxy-$1.pid
rm -f /tmp/tinyproxy-$1.log
rm -f /tmp/tinyproxy-$1-test.sh
iptables -D OUTPUT -o $DEV -j ACCEPT
ip rule del from $LOCALIP fwmark $FWM table $TB
ip route flush table $TB
ip route flush cache
echo $?


---------------

/lib/systemd/system/[email protected]

[Unit]
Description=TinyProxy Daemon for %i
PartOf=tinyproxy.service
ReloadPropagatedFrom=tinyproxy.service
Wants=openvpn@%i.service
After=openvpn@%i.service

[Service]
Type=forking
ExecStart=/etc/openvpn/tinyproxy.sh %i
ExecReload=/bin/kill -HUP $MAINPID
WorkingDirectory=/etc/tinyproxy
Restart=no

[Install]
WantedBy=multi-user.target

----------------

/etc/openvpn/tinyproxy.sh

#!/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
CONFIG=/tmp/tinyproxy-$1.conf
DAEMON=/usr/sbin/tinyproxy
DESC=tinyproxy
FLAGS="-c $CONFIG"
NAME=tinyproxy-$1

test -f $DAEMON || exit 0
set -e


if [ -f "$CONFIG" ]; then
    USER=$(grep    -i '^User[[:space:]]'    "$CONFIG" | awk '{print $2}')
    GROUP=$(grep   -i '^Group[[:space:]]'   "$CONFIG" | awk '{print $2}')
    PIDFILE=$(grep -i '^PidFile[[:space:]]' "$CONFIG" | awk '{print $2}' |\
      sed -e 's/"//g')
    PIDDIR=`dirname "$PIDFILE"`
    if [ -n "$PIDDIR" -a "$PIDDIR" != "/var/run" ]; then
        if [ ! -d "$PIDDIR" ]; then
            mkdir "$PIDDIR"
        fi
        if [ "$USER" ]; then
            chown "$USER" "$PIDDIR"
        fi
        if [ "$GROUP" ]; then
            chgrp "$GROUP" "$PIDDIR"
        fi
    fi
fi

setcap cap_net_bind_service,cap_net_admin+pe /usr/sbin/tinyproxy
bash /tmp/$NAME-test.sh
start-stop-daemon --start --chuid $USER:$GROUP --pidfile $PIDFILE -o --exec $DAEMON -- $FLAGS

echo $?