init.lua

local wifiWatcher = nil
local homeSSID = "trustedhomewifi"
local lastSSID = hs.wifi.currentNetwork()

function ssidChangedCallback()
	newSSID = hs.wifi.currentNetwork()

    networkconfig = hs.network.configuration.open()
	if newSSID == homeSSID and lastSSID ~= homeSSID then
		-- joined home wifi
		networkconfig:setLocation("Automatic")
		hs.alert.show("Welcome home!")
	elseif newSSID ~= homeSSID and lastSSID == homeSSID then
		-- departed home wifi
		networkconfig:setLocation("sshvpn")
		hs.alert.show("Danger, Will Robinson!")
	end

	lastSSID = newSSID
end

wifiWatcher = hs.wifi.watcher.new(ssidChangedCallback)
wifiWatcher:start()

• Have a network location set up in OSX called 'sshvpn' (or change the script) that routes everything trough your VPN
• Set homeSSID to trusted SSID
• Hammerspoon switches the location to 'sshvpn' when not connected to home network

.. obviously easily adjusted to support multiple SSIDs etc.