[terrywang]

Only traffic destined to the subnet in encryption domain go through the VPN connection (you can check IP routing table and identify that - interface should be tun0 or equivalent).

In case of OpenVPN remote access use case, you may have to route all traffic through the VPN connection (TunnelBlick has an option for you to tick, or you'll have to generate a new client config file), you also need proper NAT rules in place on the OpenVPN server.

To achieve what you want, blocked sites over VPN and unblocked via your ISP, extra effort may be needed, e.g. by poking around routing table and/or using dnsmasq.