On BSD you use FIBs to declare process specific routing tables, on Linux you use firewall marks to do the same, then just route all trafik through the vpn uplink and deny any other.

jfs+lvm on personal machines, ceph on storage, I used to use zfs on solaris and freebsd but haven’t touched it in linux (there isn’t any good reason, and I prefer to not break licensing)