This page mentions some of the networking features in the WP8 SDK:
What's new in the SDK
Unfortunately I don't know enough about WP8 programming to be able to tell you whether a VPN app would be possible.
Windows Phone 8 introduces the enhancements to incoming sockets. System.Net.Sockets and Windows.Networking.Sockets both support incoming sockets, which means your app can listen for an incoming network connection, and then bind to that connection.
Support for IPv6
Support for the 128-bit addressing system for devices on a network has been added to System.Net.Sockets, and also is supported in Windows.Networking.Sockets.
The Windows Runtime API, Windows.Networking.Sockets, has been adopted for Windows Phone 8. It has been implemented as a Windows Phone Runtime API, making it easy to use in whatever supported programming language you choose. Although we've enhanced the .NET API, System.Net.Sockets, to support more features such as IPv6 and listener sockets, you should consider using the new API for sockets programming because it is more portable than the .NET API. Windows.Networking.Sockets has been built from the ground up to be clean, secure, and easy-to-use APIs that enforce best practices. For more info about supported Windows Runtime API, see Windows Phone Runtime API.
Winsock native API support
Winsock native APIs are supported in Windows Phone 8. One key advantage of using Winsock APIs is that you can reuse the custom networking functionality that you’ve already implemented using Winsock, so it’s easier for you to create your app on the Windows Phone OS 8.0 platform. For more info about Winsock native API support, see Supported Win32 APIs for Windows Phone 8.