The switch is “No function (default)” by default, right? You can modify /usr/bin/switchaction to change switch action. You requiremet to turn off VPN when reboot done can be run in /etc/rc.local.
What other options do you suggest?