How can I protect myself against DNS leaks?
You can solve the problem in 2 ways:
DNS Resolver on VPN
You can install a DNS forwarder on your VPN server (if you have control of the server where it runs), set it to only forward queries coming from the VPN interface and configure your computer to use it.
Forwarding gateway
You must use two systems: one will act as the router, and route every single connection through the VPN, and the second will use the first as the default gateway.
This is the way Whonix Linux works, so even if the remote site uses WebRTC to find your local address, it will only get the useless local network address (192.168.0.x).
The first method is easier to implement and easier to maintain. The second one is more secure, as it routes everything using the VPN connection.