So the next struggle with the PinePhonePro was that I spent hours trying to figure out routing rules and such to get all traffic to go through my VPN (wireguard).

Whenever the modem reconnects, it seemingly circumvented my VPN tunnel as my IP kept changing. I was blown away that I can establish an SSH session through my VPN endpoint while still reporting a completely different external IP.

It turns out that my VPN wasn't setup for IPv6 and my mobile data was routing everything through IPv6 -- a traceroute finally revealed what was going on. No amount of setting ip route (with IPv4) would've worked. Disabling IPv6 on kernel boot got things working for me!