First, not sure if this is the appropriate site or if it would be better suited for a different one, but there isn't a networking or Windows one, so this appears to be the best place. And I'm posting here rather than the OpenVPN forums because a) this appears to be more a Windows issue than an OpenVPN one, and b) I haven't found their forums to be very helpful.
I've searched all over regarding the best way to prevent traffic from flowing without an active VPN connection, and I keep seeing the same info, but it doesn't make sense. For background, my concern isn't regarding killing torrents if the VPN connection drops, so no need to point me to binding qbittorrent to the OpenVPN interface, etc; it's for protecting privacy with web surfing and for security. I initially got looking at this yesterday trying to figure out how to prevent any data flow when connecting to a public WiFi before establishing the VPN connection (to protect random background data and protect against DNS poisoning), and to stop data flow in the event the VPN connection drops, again primarily on public networks for security reasons, but it would be ideal to have it do it even on private networks (home/work/etc) for privacy reasons. I'm on W10 using OpenVPN (not Connect).
Everything I've seen has said to set the Wi-Fi adapter as a private network, the OpenVPN adapter as a public network, and set the firewall to block outgoing connections on the domain and private profiles, but NOT the public profile. There have been some other bits and pieces here and there, but that's the general gist of it.
The problem is, if I do this, it works as expected, but if I set my network as a public network, to simulate a public connection, it no longer works. So it protects me at home, where it's not as important, but not in public, where it's much more important. And if I block outgoing connections on the public profile, all traffic is blocked regardless of whether the network is set to private or public (this took me a long time to figure out, because it's not at all clear that the private/public here is related to the OpenVPN adapter and not the state of the currently connected network), even if I set outgoing rules to allow connections on all profiles for openvpn.exe, openvpn-gui.exe, openvpnserv.exe, and tapctl.exe, which I would expect to override the general block.
Is it possible to set it up so it works on all networks to block all traffic not going through the VPN? I know it can be done through routing tables, but AFAICT that's for use with Windows' built-in VPN, so not sure if it applies to OpenVPN, and it looks more complicated to set up and more fragile, where it could easily fail. I'd really prefer to do it with the firewall, even if it means using a third-party one.
Also, I set up the OpenVPN config to bypass the VPN for the local network, to allow me to access the AP and other devices (computers, printers, router, etc) on the network without having to disable the VPN, but of course with all traffic blocked, that no longer works. So I can't access my devices on a private network, but everything's wide open on a public network... So on top of the question of getting it to work on both private and public networks, how would I then still allow LAN access on private only?