As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept a

As the other poster here says, I just configure it at the network level: my default gateway is a single-board computer set up to act as a router and intercept and rebind DNS. It's not hard, seamlessly works, and is quite fast via wireguard. My VPN provider also provides a reverse port to provide convenient ssh tunneling into the SBC "bastion host" which I have configured to use a random port, changing IP addresses, and only accept certificate-based authentication.