Not sure if this is any help, I have struggled to get a port forward to work over VPN but used a bacth file on a windows PC to redirect traffic as follows:

netsh interface portproxy add v4tov4 listenport=aaaaa listenaddress=<localhost IP> connectport=aaaaa connectaddress=<IP of device on remote VPN network>

It requires a PC to be on at all times for it to work which may or may not be an issue.

Many thanks for everyone that's been helping with this ...

So ... I've done some playing ...

2860ac --> 2830n V2 - works with 2860 firmware 3.8.6 but not with 3.8.4 which was the version I was running due to issues I had with 3.8.6 and VDSL ...
2830n V2 --> 2860ac, 2850, 2820 - doesn't work even with 3.8.6 firmware on the 2830 v2 ...
2820n --> 2820, 2860, 2850, 2820 doesn't work

If it works then it works fine with port forward & open ports ...