Don't touch VPNMASK if it's defined, otherwise use $MSK.