It does not even have to be that difficult these days. Create VPN, spin up network namespace, move tunnel interface to network namespace, start resolver in tha

It does not even have to be that difficult these days. Create VPN, spin up network namespace, move tunnel interface to network namespace, start resolver in that namespace, start VPN'ed applications in that namespace. if-up scripts for OpenVPN can do this for you[0]. As long as you operate the tunnel interface and the genuine network interface side by side some applications may simply decide to ignore default routes and explicitly bind to specific network interface. There are valid reasons to do so. For proper isolation you need to hide all the non-VPN interfaces. [0] https://www.synkretie.net/writings/easy%20namespaced%20openvpn.html https://www.synkretie.net/writings/easy%20namespaced%20openv...