I use vpn policies ip/domain and no dns resolution if dns servers are on vpn network, all is ok if I set an e ternai dns server.
On Slate ax and Slate plus, old or new kernel…