/etc/dhparam/dh-default.pem symlink doesn't exist in medkit for shield
There is no symlink to default dh params in medkit for turris shield (HBS, 5.1.4).
/etc/dhparam/dh-default.pem -> /etc/dhparam/dh2048.pem
Therefore you can't start openvpn server without manual intervention on device.
My guess is that symlink is only created during install of package.
Not sure if we will hotfix it or just wait for release of 5.2.0.