I found the problem!
Yes, the port needs to be open on the vpn container, but there’s also another change to make.
The vpn inside the container sees 172.17.0.0/16 as the local lan, so 192.168.0.0/24 is pushed over the vpn, and that’s a problem.
After I added route add -net 192.168.0.0/24 dev eth0
in the vpn container everything works.
Thanks