Why port forwarding does not work in docker when in network_mode: "other_container"

I’m trying to dockerize openvpn client and make other container use its network. Almost succeed, except one thing - forwarded port is not working:

Dockerfile

FROM alpine
RUN apk update && apk add openvpn
WORKDIR /etc/openvpn
ENTRYPOINT ["openvpn"]
docker build --pull -t 2stacks/ovpn-client .
version: '3.9'

services:
  openvpn:
    image: 2stacks/ovpn-client
    container_name: openvpn
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    ports:
      - 9117:9117
    command: --config /etc/openvpn/client.ovpn
    dns:
      - 8.8.4.4
      - 8.8.8.8
    extra_hosts:
      - host.docker.internal:host-gateway
    volumes:
      - /opt/openvpn-client/NaruzhuV3_X_GB_FVZRJDYY_10.ovpn:/etc/openvpn/client.ovpn

jackett:
    image: linuxserver/jackett:latest
    container_name: jackett
    depends_on:
      - openvpn
    environment:
      - PUID=0
      - PGID=0
      - TZ=Europe/Moscow
    volumes:
      - /jackett:/config
      - /mnt/video:/video
    restart: unless-stopped
    network_mode: "service:openvpn"

I can confirm that my IP is changing and internet connection is working with:

docker run --rm -it --network=container:openvpn alpine wget -qO - ifconfig.me
# => 149.102.xxx.xxx

but I can’t access dependent container web UI via forwarded port 9117 - it is not working (as we know when we use network_mode: othercontainer we should define forwarded ports on othercontainer).

What I miss?

FYI: it does not work in this particular setup, I have other third-party image of vpn client (gluetun) and same dependent container setup and everything is working.