Running scripts after openvpn - bash

Question

I've wrote a script to start openvpn (called vpn_up) but then I want it to also run my firewall script (called firewall_up) after starting the vpn. Here is the script that works:
#!/bin/bash
#script called vpn_up
exp_login=mylogin
exp_pass=mypass
config_file=$1
expect -c "
spawn openvpn --config $config_file --script-security 2 --up /etc/openvpn/update-systemd-resolved --down /etc/openvpn/update-systemd-resolved --dhcp-option 'DOMAIN-ROUTE .' --down-pre
expect \"Auth Username:\"
send \"$exp_login\r\";
expect \"for no echo)\"
send \"$exp_pass\r\";
interact
"
After opening the vpn, I want it to run my script firewall_up
#!/bin/bash
#script called firewall_up
# get your IP address
curl -s ifconfig.me > /tmp/ip_address
#Clear any iptables rules you might have at the moment
iptables -F
#Start building the firewall by allowing tun and your localhost
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
#Add the IP address of the VPN to the firewall
IP_LIST=$(tr '\n' ' ' < /tmp/ip_address)
for IP in $IP_LIST; do
iptables -A INPUT -s $IP -j ACCEPT
iptables -A OUTPUT -d $IP -j ACCEPT
done
iptables -A INPUT -p udp --sport 1195 -j ACCEPT
iptables -A INPUT -p udp --dport 1195 -j ACCEPT
iptables -A OUTPUT -p udp --sport 1195 -j ACCEPT
iptables -A OUTPUT -p udp --dport 1195 -j ACCEPT
#iptables -A INPUT -p udp --sport 53 -j ACCEPT
#iptables -A INPUT -p udp --dport 53 -j ACCEPT
#iptables -A OUTPUT -p udp --sport 53 -j ACCEPT
#iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p udp -j DROP
iptables -A OUTPUT -p udp -j DROP
# Stop anything not from VPN or localhost
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP
#Clean up your tempoary files
rm /tmp/ip_address
Currently, I have to run
sudo vpn_up some_config_file
in one terminal window and then run
sudo firewall_up
in another window and then it all works just fine.
I'd like to have just one script to do everything. I tried adding
--up /usr/sbin/firewall_up
to the spawn openvpn command to my first script i.e.
#!/bin/bash
# script called vpn_up
exp_login=mylogin
exp_pass=mypass
config_file=$1
expect -c "
spawn openvpn --config $config_file --script-security 2 --up /etc/openvpn/update-systemd-resolved --up /usr/sbin/firewall_up --down /etc/openvpn/update-systemd-resolved --dhcp-option 'DOMAIN-ROUTE .' --down-pre
expect \"Auth Username:\"
send \"$exp_login\r\";
expect \"for no echo)\"
send \"$exp_pass\r\";
interact
"
But it ends up running firewall_up before the vpn is actually up. I.e it uses my Initial IP address, not the IP address after the vpn is up and running. Is there any way to just add more code after the expect is finished and openvpn is done?
Any suggestions?
Thanks
As asked, here is the key (I think) output from openvpn:
Fri May 14 11:39:31 2021 /sbin/ip link set dev tun0 up mtu 1500
Fri May 14 11:39:31 2021 /sbin/ip addr add dev tun0 local 10.167.0.50 peer 10.167.0.49
Fri May 14 11:39:31 2021 /usr/sbin/firewall_up tun0 1500 1557 10.167.0.50 10.167.0.49 init
Fri May 14 11:39:33 2021 /sbin/ip route add 185.195.19.203/32 via 192.168.0.1
Fri May 14 11:39:33 2021 /sbin/ip route add 0.0.0.0/1 via 10.167.0.49
Fri May 14 11:39:33 2021 /sbin/ip route add 128.0.0.0/1 via 10.167.0.49
Fri May 14 11:39:33 2021 /sbin/ip route add 10.167.0.1/32 via 10.167.0.49
Fri May 14 11:39:33 2021 Initialization Sequence Completed
The problem appears to be that it runs firewall_up before completing the initialization.