just use tsocks. it ld_preloads over the socket functions and has a configurable table for what to redirect through the socks server (in my case ssh). it makes any program socks aware.

net result: with tsocks bash or tsocks command, you can control which processes or shells can see the vpn remotes.

tsocks + ssh -D has been my preferred vpn solution for many, many years.