I run a pretty basic OpenVPN server that is set up along the lines of the guide from DigitalOcean. It uses UFW to only allow incoming connections for OpenVPN (default port) and SSH.
Now, I also want to run a VNC service on the same system (port 5901). That's working fine with a firewall rule that allows access to the VNC port from anywhere, however I want the VNC server to be accessible only from when I'm connected to the VPN. I'm slightly dumbfounded about how such a firewall rule would have to look like. I can see in the syslog that even when I'm connected to the VPN, connection attempts from the VNC client are received from my public IP and not the internal IP given to me by OpenVPN.
Does anyone have an idea how to do this? My best guess is that I'll have to set up a source NAT, but I hope there's a simpler solution.