Unsure about routing entire VLAN to VPN

[routelots]

I'm attempting to setup a VPN based VLAN. Specifically a Wifi that is tagged, and any devices connecting to that Wifi should automatically be routed through my wireguard VPN. I've followed the "Wireguard Selective Routing to External VPN Endpoint" guide in the documents but I get confused about a few things after Step 6.

1) Since I want my entire VLAN to be routed through the VPN Gateway, what would the Firewall rule look like? Would it be as simple as "Pass VLAN net to Any" with the Gateway specified to be the VPN Gateway? Would the DNS server be the VPN provided DNS or the OPNSense DNS server?

2) How would I prevent DNS leaks if I'm setting up my network this way?

3) I don't quite understand how the Killswitch in the guide works when I'm routing my entire VLAN through the gateway?

Any guide on how to approach this would be appreciated.