Reverse Proxy with Access Control over VPN

I have a number services running on my DS1817+ in docker containers. I've setup the Synology Reverse Proxy to access these services as subdomains (e.g. https://service1.mydomain.com, https://service2.mydomain.com, etc). This all works great. The downside of this is these services are all open to the internet.

I've also got OpenVPN setup so I can access my local network while abroad and that is also working great. My local network is on subnet 10.11.0.0/24 and the VPN connected clients are 10.11.1.0/24.

I recently discovered the Access Control Profiles that can be configured for the Reverse Proxy. This allows me to restrict access to the Reverse Proxy based on subnets. So if I restrict to 10.10.0.0/24 then only devices on my local subnet can actually connect through the reverse proxy. This also works great - my local devices can connect using the reverse proxy addresses but devices outside the local network cannot (they get a "Sorry, page not found" message).

But I can't get the combination of VPN and Access Profiles to work. I'd like to connect to the VPN while abroad and then use the reverse proxy addresses to connect. But it doesn't work (I get the "Sorry, page not found" message).

My Access Profile is defined with two ALLOW rules (10.11.0.0/24 and 10.11.1.0/24) and one DENY rule (ALL). But I can't get the clients connected through the VPN to access the Reverse Proxy addresses.

Any ideas? Or is this not a supported way for things to work? Would it work if I used a different reverse proxy method?