Oh, i found my problem. That was an incorrect testing procedure. Did not enable the vpn on the second tab, so system somehow detects it and rejected the ref. Nice. For anybody testing the ref system and has faced the same problem: check the node logs for a string "Error: Hijack attempt blocked", if it is check if you are using the same session (I suppose?) on a second tab.