I am using only the anti-leak firewall rules in dom0 since it is must simpler than the nftables.
Which leak cases will be covered by nftables which are not blocked by dom0 firewall approach?
(Cross-post: How To make an OpenVPN Gateway in Qubes (4.2, 4.3) - #2 by whoami)