Force a VPN connection for all WiFi networks, except those included in a list of trusted SSIDs. Save to /etc/NetworkManager/dispatcher.d/vpn and enable NetworkManager-dispatcher.service

vpn

#!/usr/bin/env ruby

wan_iface     = '<wifi network interface>'
vpn_name      = '<vpn connection name in NetworkManager>'
trusted_ssids = ['<trusted>', '<wifi SSIDs>']
ssid          = `iwgetid -r`.chomp

interface, status = ARGV[0..1]
exit unless interface == wan_iface

def conn_up?(conn)
  system('nmcli conn show -a | grep -q "^%s\b"' % conn)
end

case status
when 'up', 'vpn-down'
  if !trusted_ssids.include?(ssid) && !conn_up?(vpn_name)
    `nmcli conn up id "#{vpn_name}"`
  end
when 'down'
  if conn_up?(vpn_name)
    `nmcli conn down id "#{vpn_name}"`
  end
end