We're currently using using Linux servers running FreeSwan for VPN connectivity, and Cisco WAN routers. Basically, the Cisco's have default routes to the internet via the VPN server so that if a route is lost, traffic to that destination goes out the default. The VPN server knows what needs to be encrypted and what doesn't.
This setup could work with other device types, as it's just based on the dynamic routing protocol updating the routing tables. The VPN endpoint and the WAN router could even be the same device.