Comment 14 for bug 1580356

Doing as the OP suggested does work. the following modification of lib/systemd/system/openvpn@.service allows the AWS xenial instance to reboot with openvpn service enabled

$ diff -u /lib/systemd/system/openvpn@.service roles/openvpn_server/files/openvpn@.service
--- /lib/systemd/system/openvpn@.service 2016-02-02 06:33:30.000000000 -0600
+++ roles/openvpn_server/files/openvpn@.service 2016-06-27 15:55:19.839586907 -0500
@@ -3,6 +3,7 @@
 PartOf=openvpn.service
 ReloadPropagatedFrom=openvpn.service
 Before=systemd-user-sessions.service
+After=network.target network-online.target
 Documentation=man:openvpn(8)
 Documentation=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
 Documentation=https://community.openvpn.net/openvpn/wiki/HOWTO