This is a decent article. However, it's a bit vague on the vulnerabilities of VPN services. The major risk is probably traffic leakage after uplink interruptions, or changing WiFi APs. Once the VPN connection has failed, default routing must be restored in order for reconnection to occur. There must be firewall rules to prevent other traffic from using the physical NIC during reconnection. That is, you want the VPN to fail closed.
Another risk, which the article may vaguely allude to, is using ISP-associated DNS servers. Even if all traffic uses the VPN tunnel, DNS requests reveal sites being visited, and it's trivial for ISPs to correlate them with traffic.
IPv6 is a huge looming risk. Many VPN services don't route or block IPv6 traffic. As full IPv6 service becomes widespread, there will be major pwnage. However, this is easy to firewall, and good custom VPN clients do so.
I've used that for several months. Regarding security in my eyes this only secures that the DNS request is not hijacked by a third party (like Turkey has done with Google's 8.8.8.8 DNS once). All the IP addresses your computer visits can simply be backcoded through a reverse DNS and so it does not hide which websites you are visiting.
Don't forget WebRTC. It can leak your real IP address and might even be able to use that route.
Nevertheless, setting your Firewall to only allow VPN traffic is pretty easy. I've done that on Linux and Mac OS X. I don't think it is complicated on Windows either.
In Windows Firewall, you label the physical and tap adapters as different domains. Then you allow only connections with the VPN server via the physical adapter. It's not all that different from iptables. I'm not very familiar with pf, but I'm guessing that the approach is similar.
WebRTC is indeed invasive. But WebGL is arguably worse. HTML5 overall is hard on privacy.
Another risk, which the article may vaguely allude to, is using ISP-associated DNS servers. Even if all traffic uses the VPN tunnel, DNS requests reveal sites being visited, and it's trivial for ISPs to correlate them with traffic.
IPv6 is a huge looming risk. Many VPN services don't route or block IPv6 traffic. As full IPv6 service becomes widespread, there will be major pwnage. However, this is easy to firewall, and good custom VPN clients do so.
Edit: For suggestions about leak-testing, see https://www.ivpn.net/privacy-guides/how-to-perform-a-vpn-lea...
Edit: Changed "URLs" to "sites".