Always-on VPN sends no traffic
I think the problem is an bug in android kitkat listet as  Issue 64819.

it says:


  Android 4.4 VPN: DNS request packets' source IP address is always private address
  
  A packet capture shows that the DNS packets are sent out of the public
  interface, as expected, but source IP address is the VPN-assigned
  private address, which is not publicly routable.
  
  This issues does not occur on Android 4.3.


see here:
https://code.google.com/p/android/issues/detail?id=64819