If you're connected to a random network, whose configuration you don't know in advance, how do you route packets to your VPN server?
The usual answer is that the network's router tells you how to do that, by supplying DHCP options.
The point I'm making here is that you can't just configure a firewall rule and have it work properly. What actually needs to happen is that the VPN client software is using one routing table - let's call it "host routing" - and everything else on the system is using a second routing table - let's call that "VPN routing".
The DHCP server inserts rules into the host routing table, and the only software using those rules is the VPN client for its management and tunnel traffic.
Otherwise, what if the network to which you connect says "the next hop for all internet traffic is 10.10.10.10"? You need to respect that rule when sending traffic to your VPN server, and ignore it for applications whose traffic will be tunneled.
The usual answer is that the network's router tells you how to do that, by supplying DHCP options.
The point I'm making here is that you can't just configure a firewall rule and have it work properly. What actually needs to happen is that the VPN client software is using one routing table - let's call it "host routing" - and everything else on the system is using a second routing table - let's call that "VPN routing".
The DHCP server inserts rules into the host routing table, and the only software using those rules is the VPN client for its management and tunnel traffic.
Otherwise, what if the network to which you connect says "the next hop for all internet traffic is 10.10.10.10"? You need to respect that rule when sending traffic to your VPN server, and ignore it for applications whose traffic will be tunneled.