I have some bad news about using a VPN on CX metal. The VPN connection nicely sets up and within a minute, the VPN connection drops.

This happens for both a commercially available VPN as well as private company (so non-published IP's) VPN connections.

Looks to me, deep packet inspection is being done (the great China Firewall mechanism) and everything looking like a VPN just gets a "connection closed" on both sides. Restarting the VPN connection brings back the VPN online and a minute later, the connection is gone again.

So, IF you want to do VPN, you will need obfuscating VPN versions.