VPN Client & Group/Device rules

I've just set up the VPN Client with Surfshark on my Blue. The VPN link appears to be working well however there's something odd happening with the way that the VPN is interacting with Rules.

So, I have my (Synology) NAS in an 'NAS' group and it's the only device in the group (I find that having a group for it keeps the Rules safer, because I lost them all before as a result of the device vanishing when its IP address changed). The NAS group has multiple rules that allow access to the various Synology and Plex domains that appear to be needed. In addition to the rules the group then has the internet blocked. This all worked fine until I enabled the VPN Client for the group, at which point the NAS appears to lose access to the internet. If I unblock the internet then everything works fine again. So I have this wierd situation:

1. If (for the NAS group) the VPN is enabled and the internet is blocked then the NAS CANNOT see the internet

2. If (for the NAS group) the VPN is disabled and the internet is blocked then the NAS CAN see the internet

3. If (for the NAS group) the VPN is enabled and the internet is not blocked then the NAS CAN see the internet

So it appears that either the VPN can be enabled OR the internet blocked, but not both.

Anyone know what's going on here? Thanks