[megous]

Or just uidrange based policy for a separate routing table that just routes to the VPN. Just one thing to set up.