blocked (can make connection but can only ping router) if I have a 'block all' WAN to Lan IP filter in the firewall rules. Works fine when I disable the rule.

Any idea what new rule is needed to allow this to work?

OK, seems the router treats the VPN assigned IP as Wan > Lan and applies the block rule as it would with any WAN IP. An exception needs to be created for the teleworker IP range to allow access (in my case the RDP port).

Anything else I need to know about this?