Setting Accessibility to LAN only should also include OpenVPN subnets
OpenVPN is "sold" as being able to access your services as if you are directly connected to your LAN, but the OpenVPN subnets are not included in the permitted IP ranges when setting Accessibility to LAN only.