$VPN_CONFIG returns a path, not a tunnel interface name. That's my bad. Getting the basename should work fine.