#BOFH: configure DHCP to add static routes for 128.0.0.0/1 and 128.0.0.0/1 to your gateway.
This effectively prevents traffic from being routed through a VPN (which usually changes only your default route).
This should have said 0.0.0.0/1 for one of these options of course :)