Create a TUN device via VpnService.Builder once the CHILD_SA is established