There's four ways to go about this (sorted from easiest to most complicated):
- Use a VPN provider that already offers a SOCKS5 proxy (like Mullvad), and then connect to this SOCKS5 proxy from NetGuard
- Use AFWall+ (root required) instead of NetGuard. That way you can use a VPN app "normally".
- Install a VPN app and a SOCKS5 proxy server in the Android work profile, and then connect to this SOCKS5 proxy from the main profile using NetGuard.
- Self-host a VPN-to-SOCKS5 server
I've only ever used the third option, so that's what I'll describe here.
Pros:
- It doesn't require root
- You don't have to pay for a specific VPN (you can use Proton VPN)
- You don't have to run/pay for any servers
Cons:
- The work profile has to be enabled constantly for the VPN to stay running, and that uses considerable battery
- A work profile uses a about 398.53MB of storage
- The VPN service doesn't fully work on some Android devices: It's known not to work in some LG devices running Android 9, but it does work in a Moto e6 Plus running Android 9
Steps:
- Install personalDNSfilter
- Install Island or Shelter (Preferibly Shelter, because it's FOSS and has no trackers)
- Setup Island/Shelter
- Setup personalDNSfilter to your liking
- Install "Every Proxy" in the work profile
- Install a VPN app (such as Proton VPN) in the work profile
- Disable battery optimizations for all of the apps you just installed (personalDNSfilter, Every Proxy, Proton VPN, and Island/Shelter)
- Configure "Every Proxy" to run a SOCKS5 proxy on the 10.1.10.1 interface, and set a username and password (Warning: do not make the password 126 characters long, that causes a crash. I recommend making the password 40 characters long.)
- Make sure NetGuard is running
- Start the SOCKS5 proxy in "Every Proxy"
- Set personalDNSfilter in Netguard as "unmanaged" (untick the "apply rules and conditions" box)
- In Netguard set the DNS servers to any WAN servers (for example: 94.140.14.14, and 94.149.14.15) (nothing will be sent to these servers)
- Create TCP and UDP forwarding rules for 127.0.0.1:53 -> 127.0.0.1:5300 to personalDNSfilter in NetGuard. Note that this isn't possible if you downloaded NetGuard from the google playstore. You must download netguard from either Github or from F-Droid
- Configure Netguard to use a SOCKS5 proxy server (10.1.10.1:1088, and input the same username and password as you did in "Every Proxy")
Done!
Here's a flow chart of how/why this works:

I made a much more detailed guide on my blog. It's linked below:
How to use NetGuard + personalDNSFilter+ Any VPN, without root, without external self-hosted servers.
https://itsignacioportal.github.io/netguard-pdnsf-any-vpn-combo/
iptables
instead of a VPN, though.