There’s quite a lot of information missing here for us to really offer much more help.
These days Cloudflare won’t fail in proxy (orange cloud) mode as long as HTTPS isn’t set to strict, as both :80 (HTTP) and :443 (HTTPS) are being passed directly to the server.
Strict forces traffic on :80 to be redirected to SSL, and thus the challenge would fail.
It’s quite possible you’ve missed one or more of the fundamentals, but without telling us where the VPS is located and what you’ve configured within DNS we’re going to be guessing at best as to what’s happening here.
Some providers require ACLs be set between their VPS and the outside world - have you verified those ports are open externally? Are you sure the ‘a’ record you’ve added to DNS is to the public IP address which has been allocated? Are there any firewalls present?
That’s true with some DNS providers, sure, but Cloudflare forces a TTL of 300 seconds on any address they proxy. That means any upstream DNS servers will have expired the old records within five minutes of the change.
All the template does is ensure the correct client IPs are being pulled out of the extra header information Cloudflare adds when proxy mode is enabled, it’s not really relevant to the install process.