Thanks, I think that will work.
I'll write 2 similar scripts - one to check if backup is on and restart the VPN and one to check if main is on and restart the VPN. The second one will be disabled in scheduler. When the first one executes it will disable itself and enable the second one and vice versa.