Could you use qbittorrent and bind the network interface to ProtonVPN? And then split tunnel whatever apps you want from the GUI?

If you are on Linux the best option is to run this:

https://github.com/haugene/docker-transmission-openvpn

Basically a small "virtual machine" that assures that the torrent traffic always passes through the VPN. No VPN=no traffic

If you go the qbittorrent route, my piece of advice is to always check the settings after any updates.

It was maybe around 8 or 9 years ago, but after one of the updates, all my settings got wiped and set back to defaults I assume.

I didn't notice until I ended up getting a nastygram from my ISP.

It's never happened since, but needless to say I always double check now.

wouldn't just changing the network interface in your torrent client to your vpn do this anyway?

Best thing to do in a situation like this is to have a bake off. Just pay the smallest amount of money you can to test out other services till you can form your own opinion.

I would test mullvad. It does split tunneling with a kill switch at the same time, it also allows you to do local networking without split tunneling. It doesn't do any logging and you can pay in cash. I use it to seed and in my torrent app (qbittorrent) I set it to only connect to internet through my VPN so even if the kill switch somehow failed, the moment I'm no longer on the VPN my torrents stop no matter if I'm leeching or seeding.

For further research, I suggest the piracy megathread

I am attempting to solve this via firewall. I block all RFC1918 source traffic on the LAN interface but allow all traffic on the VPN interface. That seems to function reliably. I’ve tested that I can egress while the VPN is active but not at all when it goes down.

If this is not a good solution, let me know, but it seems reliable and doesn’t require any other tooling.

I realize this doesn’t fit your use case since you have other connections you don’t want in the VPN, but I’m still curious if others use this setup.

The only real constraint here is VPN port forwarding. You would need a VPN provider that supports that in order to hit DHT swarms. So, just make sure the provider has that.

As for kill switching, run the VPN and torrent client through docker. There is probably already a docker image out there that does that depending on what provider you go with. Essentially what you'd be doing is sandboxing your torrent client and then only passing in the VPN interface via docker network to that client. If the VPN tunnel goes down there is no other egress point off the network segment and zero chance for traffic using a different interface.