VPNs over NoCatAuth

There have been a few discussions of VPNs over NoCat, but not many in awhile,
and none addressing this issue.

I've had a couple users who, when they use their VPN client to establish 
connection with the VPN server, their renewal window fails to refresh, and
their connection dies.  Looking at it architecturally, this makes perfect
sense.  The renewal URL to the gateway is a local address, which works as
long as the client uses a local DHCP address.  Once the VPN tunnel forms,
don't they get an IP address on the remote tunneled network, and all traffic
goes through the tunnel?  The request for a renewal refresh goes through
the tunnel and cannot be resolved, as it is only valid on the local network.
(The gateway is not accessible from the outside 'net.)

If I manually permit (using the fw_exception script) the IP and MAC of the 
VPN user, his VPN works perfectly, albeit he is not subjected to the splash
page and has no renewal window with which to contend.  We would like to keep
the splash page/renewal process intact--how can we handle the VPN tunnel
situation?

Brendan