I have solved the issue and will post my solution here in case somebody else comes here looking for information. In my case it was adding the dhcp-option DNS to the configuration file and some extra rules on the iptables that did the trick.
A more detailed explaination of the installation is here: GitHub - blurrryy/pihole-nordvpn-dhcp: Tutorial how to setup the RaspberryPI as NordVPN Gateway with PiHole and DHCP-Server . It is written in German, so I will outline the most important parts below.
I started all over again and installed openvpn first. For this the tutorial linked in the original post can be followed for the most part (https://www.instructables.com/id/Raspberry-Pi-VPN-Gateway-NordVPN/).
Important is setting a static IP (not described in this tutorial).
sudo nano /etc/dhcpcd.conf
And in this file add the following lines:
interface eth0
static ip_address = 192.168.2.22 / 24
static routers = 192.168.2.1
static domain_name_servers = 192.168.2.1 8.8.8.8
In my case 192.168.2.22 is the desired IP of my pi, and 192.168.2.1 is the IP address of my router.
Install the NordVPN configuration files as described. The tutorial tells you to select one server and set this up as a .conf file. But I choose to let the pi choose the most suitable server of a specific country when starting the connection. How to do this is described here: Configuring Raspberry Pi as a VPN gateway using NordVPN with best server selection (Pi-hole with DoH setup optional)
Basically you get a link from the NordVPN website, paste it into a python connection script and then set this script up to run at boot.
In the instructions (the ones on zone13) it is explained how to create a python script to update all .ovpn files with the login credentials. I have modified this snipped to also add the DNS info at the end.
#!/usr/bin/env python
import fileinput
import glob
import os
os.chdir("/home/pi/vpn/test")
file_list = glob.glob("*.ovpn")
for item in file_list:
for line in fileinput.input(item, inplace = 1):
print (line.replace("auth-user-pass", "auth-user-pass login.txt").replace("</tls-auth>", "</tls-auth>\n\npush \"dhcp-option DNS 192.168.2.22\"")),
So replace the filename "login.txt" with the filename of your credential file. And the DNS IP with the IP of your pi.
I installed the iptables rules as explained in https://www.instructables.com/id/Raspberry-Pi-VPN-Gateway-NordVPN/. However I added some additional ones to make it work with the pi-hole:
sudo iptables -I INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --destination-port 53 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --destination-port 53 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --destination-port 1194 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --destination-port 1194 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --destination-port 80 -j ACCEPT
Then I did a reboot and installed pi hole. During installation the static IP and gateway IP is both set to the IP of the pi.
In the pi-hole web interface change the upstream DNS servers to the one from NordVPN. (103.86.96.100 and 103.86.99.100).
Also change the 'interface listening behavior' to 'listen on all interfaces'.
I tested the setup for DNS leaks and found none.