Is this the correct dns setup via vpn tunnel iptables?

Question

Domain Name System

Hello!
In general, I am new to Linux.
I want to go to the Internet through vpn-tunnel. It seems that I set everything up and wrote the rules in iptables so that all traffic is wrapped in a vpn tunnel, but I don’t fully understand whether I did everything right, I have doubts about DNS traffic. It seems to me that it does not go through the VPN tunnel, but directly bypassing the tunnel, albeit to Google resolvers.
Here are the rules:
# Deleting old iptables rules
#
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
#
# Set default policies for INPUT, FORWARD and OUTPUT chains
#
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
#
#Allow loopback device (internal communication)
#
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
#
#Allow traffic from DHCP
#
iptables -A INPUT -p udp - -dport 67:68 --sport 67:68 -j ACCEPT
#
#Allow VPN establishment
#
iptables -A INPUT -s ip_VPN -j ACCEPT
iptables -A FORWARD -s ip_VPN -j ACCEPT
iptables -A FORWARD -d ip_VPN -j ACCEPT
iptables -A OUTPUT -d ip_VPN -j ACCEPT
#
#Accept all TUN connections (tun = VPN tunnel)
#
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
#
ip_VPN respectively IP address of the VPN service through which I connect.
In the connection manager, I registered google dns and the rules spelled out as you can see
iptables -A INPUT -p udp --dport 67:68 --sport 67:68 -j ACCEPT
so I don’t understand how dns traffic goes through the tunnel or through the bare provider to google-dns resolves there and already when the IP address of the site domain is known, then the sites are already loaded through the tunnel ???
Knowledgeable experts, please tell me, don't let me hate my still beloved Linux

Answer 1

I don’t want to upset you, but in order for “traffic to turn around”, you need to register routes, and not rules for netfilter

Answer 2

Break your keyboard if you can't type tracert 8.8.8.8