[sneak]

iPhones/iOS leak stuff past the VPN constantly. I am also keeping my location changes private from Apple, and the phone maintains a persistent connection to APNS at all times, leaking the client IP, and will do so even if the VPN on device goes down. There are also DNS leaks exposing the device's client IP.

I also have root on the hotspot device and can block access to specific IPs or hostnames, and can run tcpdump to monitor traffic. It's pretty nice for seeing what spyware various mobile apps have embedded in them.

You could also run the VPN on the phone itself, and just use the firewall on the hotspot to prevent traffic to any IP other than the VPN endpoint, closing the iOS VPN leaks, but I connect 3-4 devices to the hotspot and want VPN on all of them, so doing the VPN on the hotspot is slightly more convenient.