Finally works (with standard NetworkManager and OVPN plugin).

Script vpndnsfix.sh

#!/bin/sh
nmcli -p connection modify $1 ipv4.never-default no
nmcli -p connection modify $1 ipv4.ignore-auto-dns no
nmcli -p connection modify $1 ipv4.dns-priority -42
nmcli -p connection modify $1 ipv6.never-default no
nmcli -p connection modify $1 ipv6.ignore-auto-dns no
nmcli -p connection modify $1 ipv6.dns-priority -42

Usage

vpndnsfix.sh MY_VPN_CONNECTION_NAME
nmcli -p connection show MY_VPN_CONNECTION_NAME 

In this case once VPN connection is established, all DNS requests are directed to VPN-supplied DNS servers without any manipulations with dnsmasq, up/down/dispatch helper scripts.

См. также:

• NetworkManager bug 1624317
• After connected to VPN, systemd-resolve still use ISP's DNS server ( which was polluted because of regulation )
• NetworkManager is not changing /etc/resolv.conf after openvpn dns push

FB