check_vpn: smarter device allocation