Well, don't let whatever application you run access arbitrary networking of any kind. Like, literally hide the LAN adapter from it. Then add a virtual adapter f

Well, don't let whatever application you run access arbitrary networking of any kind. Like, literally hide the LAN adapter from it. Then add a virtual adapter for/from the VPN software. This worked from the beginning on for IPv4 and IPv6 (probably also more exotic networking protocols) on Linux, though I don't know how hacky the Windows equivalent to this is.