Following the announcement of 12.1, we've updated the TurnKey PVE channel with the new appliances, both 32-bit and 64-bit. You can force the channels update as follows (or wait for the daily refresh):

/usr/bin/pveam update

As noted in the announcement, 12.1 comes with the 'headless initialization fence' which leverages iptables to create a sort of virtual fence around an appliance

In PVE 1.9 (please leave a comment if this is also true in later versions), the default configuration doesn't support VM iptables, so the fence won't be created. The fix is simple though (source):

Edit /etc/vz/vz.conf, comment out the default IPTABLES and add the following:

IPTABLES="ipt_REJECT ipt_recent ipt_owner ipt_REDIRECT ipt_tos ipt_TOS ipt_LOG ip_conntrack ipt_limit ipt_multiport iptable_filter iptable_mangle ipt_TCPMSS ipt_tcpmss ipt_ttl ipt_length ipt_state iptable_nat ip_nat_ftp"

Then restart the service:

/etc/init.d/vz restart