ASUS RT-AC68U restrict external access

[telicha]

Hello! my ASUS RT-AC68U is configured in such way that the LAN address is 10.0.0.1 with subnet 255.255.255.0 and the VPN server is configured with TUN, and a VPN subnet 10.8.0.0 netmask 255.255.255.0.

All devices 10.0.0.x are connected with wires and can access each other, no problem. The issue is that when I connect from outside, I have access to all the devices in the internal network, but I would like to restrict external access to only some devices. Say I wanted to allow external (VPN) access to devices from 10.0.0.128 thru 10.0.0.254 but the devices in the range 10.0.0.1 thru 10.0.0.127 could not be accessed from outside (the reverse would be fine too) ... Can that be done with the ASUS router VPN server? How to set it up?

Thanks!

here are my settings:
interface type - TUN
protocol - UDP
server port - 1194
firewall - Auto
authorization mode - TLS
username auth only - no
Extra HMAC authorization - Disable
VPN Subnet/Netmask - 10.8.0.0 255.255.255.0
poll interval - 0
push LAN to clients - Yes
Direct clients to redirect internet traffic - No
Respond to DNS - No
Encryption Cipher - Default
Compression - Adaptive
TLS renegotiation time - -1
Manage Client-Specific options - no