In order to stop DHCP server on client side, you have to setup a cron with a script that checks the connection with the VPN server, so if connection is present the script will stop the DHCP server, and when connection is lost, the script starts DHCP server. Anyway I don't see why this is ever needing.
The VPN connection is opened by the user on the client side from the command line. Instead of starting OpenVPN, he could run a script that performs other management functions as well. So I think using an additional cron job would not be necessary.
The reason I assume I might have to renew the DHCP leases is that machines on both sides of the VPN bridge might not know the IP addresses of machines on the other side because they only know about their local DNS server. But may be there is a way to tell them about the "other" DNS server and revoke that information once the VPN bridge is closed?
can you force a DHCPNAK once the VPN is up
I'm not sure. Both LANs use dnsmasq as their DHCP / DNS Server. dnsmasq is pretty flexible, but I have not found a hint on how to issue a NAK. Wouldn't that be send out only in response to a DHCP request anyway? In that case, I'd still have to find a way to force the clients to issue such request.
