Place in /etc/NetworkManager/dispatcher.d/ to automatically connect to VPN on network changes

50-vpn-up

#!/bin/bash
WIRED_ONSITE="eth0"
WIFI_ONSITE="onsite_ssid"
VPN_ONSITE="vpn-onsite"
VPN_OFFSITE="vpn-offsite"

function online {
  nmcli con show --active | grep -qs "^$1"
  return $?
}

function connect {
  online "$1" || nmcli con up id "$1"
}

function disconnect {
  online "$1" && nmcli con down id "$1"
}

function connect_onsite {
  disconnect "$VPN_OFFSITE"
  connect    "$VPN_ONSITE"
}

function connect_offsite {
  disconnect "$VPN_ONSITE"
  connect    "$VPN_OFFSITE"
}

function activate_vpn {
  interface=$1 status=$2
  case $status in
    up|down)
      if online "$WIRED_ONSITE" || online "$WIFI_ONSITE"; then
        connect_onsite
      elif nm-online -qx; then
        connect_offsite
      else
        disconnect "$VPN_ONSITE"
        disconnect "$VPN_OFFSITE"
      fi
      ;;
  esac
}

if [[ "$1" =~ eth|wlan ]]; then
  activate_vpn "$1" "$2"
fi