you are doing nothing wrong. To my knowledge, there is no effective firewall app for android that doesn't occupy the VPN connection. From my understanding, you either have a VPN or a firewall. I have found no work around for both that was effective.
I have a strange bug where RethinkDNS wireguard session keeps failling after a while if my phone is not used for a while.
I have to reconnect my wireguard session or it just doesn't work. I need to ADB and check the logs to see what's happening and write some kind of bug report to rethink's DNS bug tracking support.
It's not the first time they have some kind of misbehave with their firewall and wireguard tunnel. Other than that, RethinkDNS rocks !!
Always on vpn. I have no need to use these other VPNs like everyone else is, but if I were I'd set that up on my opnsense firewall at home. That way everything in my network, and my phone's when away from home, are all tunnelled through the VPN provider. Opnsense does all the content filtering and security stuff well enough for my needs.