pfsense does that by default. If the VPN connection is deemed to be down (it does some pinging to evaluate it) it silently defaults to unencrypted. There is a

pfsense does that by default. If the VPN connection is deemed to be down (it does some pinging to evaluate it) it silently defaults to unencrypted. There is a convoluted way to configure it so that it blocks VPN IP packets from going directly to the WAN, but I noticed it seems to terminate connections when some packet is lost.