In addition to the above perhaps this example might help provide inspiration:
The idea is to set a routing table for each interface and then set rules for routing packets through each interface.
I think the reason your rule above doesn't work is because it lacks a routing table for VPN.
So I think you should label tables as described here:
Here are mine:
root@OpenWrt:~# cat /etc/iproute2/rt_tables
#
# reserved values
#
128 prelocal
255 local
254 main
253 default
0 unspec
#
# local
#
#1 inr.ruhep
1 br-lan
2 br-guest
3 vpn
4 wan
And then in LuCi assign tables to the interfaces.
And then set up rules in LuCi like you have been doing, only be sure to specify the appropriate routing table for each rule.
And if you want to use CAKE for sqm in this context consider this very simple script rather than the default package:
@trendy I believe OpenWrt somehow automatically sets up routing table entries with the above. At least it did for me.
I really like this approach because it is elegantly simple and allows a lot of manual customisation.