Right. There's no stock way to do that, but I imagine a background script on the N7 could figure it out. Something that just monitors the current AP SSID, and when it sees it has connected to the N4, it fires up the VPN.

That shouldn't be difficult to do from a bash script. Over in the Android Apps thread someone recommended a fancy scripting app of some kind that can respond to events (eg. WiFi connected) and customize stuff like that with ease. Perhaps worth looking into?

Cheers