If it can be turned off, then it's not locking down the entire system. Which did sound implausible anyway.

Bitt's routing table point makes the most sense, and having the VPN shut down when it see changes would preclude my original suggestion of simply creating a new route for the printer.