With some trial and error and help from a different forum, I managed to get this working. Note, I switched to OpenVPN protocol on account of better support in linux and just overall better throughput.
The only part that can be done with GUI is setup for the OpenVPN connection, and the client network on the second interface (this is done in network manager). In my case, ens9 is a secondary Ethernet interface that I configured with static IP on a unique local subnet. Client devices were pre-configured to use this IP as their gateway.
Full verbose details of my solution here: https://www.linuxquestions.org/questions/linux-networking-3/share-vpn-with-ethernet-interface-4175655027/
VPN kill-switch for the Gateway device itself goes like this:
Make these changes in /etc/sysctl.conf
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
#enable packet forwarding
In UFW’s default config file (/etc/default/ufw), make this change:
Through command line, edit the ufw rules as so:
sudo ufw default deny incoming
sudo ufw default deny outgoing
sudo ufw allow out on tun0
sudo ufw allow out on wlp2s0 to XXX.YYY.ZZZ.AAA port 1194 proto udp
In the last line, use the name of the interface you are using for the WAN connection (use ifconfig command to see all interfaces), and use the IP address and port number for your OpenVPN server – this can be lifted from the ovpn.config file supplied.
This much gets you a working VPN kill-switch on the gateway device. The last step is masquerading the VPN connection on the secondary interface (in my case, the Ethernet device called ens9).
Don’t use the GUI method from nm-connection-editor to enable sharing, it will bypass your kill switch. Instead, edit the file /etc/ufw/before.rules by adding a nat section just above the *filter heading:
### Start OpenVPN Share rules
### NAT table rules
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.10.0/24 -o tun0 -j MASQUERADE
Where 192.168.10.0/24 stands in for the IP address range of your client network. In my case, I defined it statically within that range.
And that was pretty much it.
I expected to need a ufw rule like this:
sudo ufw allow out on ens9 to 192.168.10.0/24
But it works just fine without it.