Run the VPN right from the device itself, allowing for DNS blocking of whatever you want. Previously, Blokada was used, now Rethink DNS is preferred.