RV042 Group VPN & access rules

Question

I've setup a GroupVPN and connect to the RV042 with the Shrewsoft VPN client, works like a charm as opposed to QuickVPN ;-)
The firewall is configured with an explicit deny rule for RDP access to an internal server, also an explicit allow rule is created for certain IP numbers as source. I noticed that I need to create an explicit allow rule for the subnet the Shrewsoft client is using for the virtual adapter or I will not be able to access the internal server via RDP through the GroupVPN tunnel. 
Is this by design? I would think that setting up a tunnel defies the rules created for direct access on the WAN port.
Peter

Answer 1

sorry, I got my signals crossed with my previous suggestion.  Your reply cleared up my misunderstanding.  My rule was for a different purpose, and does not work for your situation as I thought it would.
port forwarding (UPnP or Forwarding) supersedes the firewall rules but does not completely bypass them. It must bypass the default rules to work, but does not pass the custom rules.  The trick is knowing that the forwarding translation happens first, so when it is processed by the firewall, the destination is the internal IP and port.  Also, it would seem that VPN works similarly - bypasses the default firewall rules but not custom ones.
Since you want to double up your security and have a non-standard port PLUS limit access to specific IPs via firewall rules, then you are configured correctly. 
Should the VPN bypass the firewall completely?   Maybe, but then you wouldn't have the ability to filter VPN clients with custom rules (without a separate VPN firewall section).  Since you created a custom block rule, you must add an Allow rule for ANYTHING coming through the WAN port (even VPN).   I agree this is annoying, but it's just how the programming is written.
I did not test the VPN rules, but I think you can handle that - the only variable should be do you allow for the remote network public IP or the remote LAN subnet range?  I would expect the LAN subnet.
Other thoughts - personally, I just use the non-standard port and let RDP security take care of itself.  My clients are very small businesses, so exposure and risk are pretty low.  For a higher-profile or higher-security client, I would either put everything inside a VPN connection, or configure as you have.  Of course, if security is that important, maybe you should be on a more expensive (and capable) device?