It's been a while since I set up a self hosted VPN service on my network. (Because it has simply worked reliably since I set it up initially). I do know that you have to specify which subnets you want to be able to access over the VPN connection. Many online guides just use the LAN subnet (and don't explain that you need to add any other subnets) when they set it up because they are assuming most people have a flat network without VLANs. It's not so much that you have to enter VLAN tags when you set the connection up, but you do have to add the IP subnet for every VLAN you want to access over the VPN. I fact, I don't recall having to enter any VLAN tags in my setup at all (but it's been a few years since I looked at those settings).
Let me also clarify - all of these "extra" subnets need to be added to the VPN setup regardless of any firewall rules you have set up to control local access. For example, if your LAN has an "Allow All" rule that lets devices on that subnet to access device on all of the other VLANs, simply entering the LAN subnet in the VPN setup will not carryover and allow external devices connecting to the local network access to anything other than the LAN network. You do still need to add all of the other VLAN subnets that you want to be able to access from the VPN connection while outside of your local network. I initially thought that because I had access to all of my VLANs while on the LAN while on my local network, that it would work the same way when I connected through the VPN. I realized quickly that while I had access to the LAN network over VPN, I didn't have access to the VLANs until I added their subnet's to the VPN setup.
