Most routers have a "vpn passthrough" option that is on by default. It may have sub options of pptp, l2tp, ipsec. Otherwise you can block domains in the router as well. Something like .surfeasy.com might work.
That method depends on if the initial connection requires resolving. I suspect it does because I accidentally blocked the opera vpn once with one of the opendns filters - think it was proxies. So that's another option, customize opendns configuration.
Once a vpn or proxy connection is established though, local hosts files and dns settings become irrelevant as they are controlled by the vpn/proxy. So some vpn or proxie that uses an ip number for the initial connection wouldn't be affected by any domain filters.
