If you are limiting the discussion to included stock VPN implementations, doesn’t that basically just include IPsec? Most secure third-party options will drop packets that aren’t destined for an encrypted tunnel, even while not running.