DHCP can add routes to a client’s routing table via the classless static route option 121. This blog post discuses how to take advantage of that fact to render VPN on iPhones useless.