Sixxs usually provides at least one subnet (/64 prefix) in addition to the tunnel endpoint address. It might be a good idea to cofigure this additionally for browsing and application use to avoid user tracking by ip. It would be nice to have this set up at tunnel connect.
This requires support by the VpnService API.