Right. No matter they are in local or public net, devices that are not ruled by PBR can access the server by public address (default route is WAN, configured VPN with route-nopull).
What I tried to do to solve this problem: For example, for a local device 192.168.1.13 I defined PBR rules with interface WAN or VPN and remote ports are the same that 192.168.1.11 has defined as local ports, e.g. 0-24 26-87 etc. This device 192.168.1.13 can then access the server by public addresses.
But the problem is, when i define for all local devices "192.168.1.1-192.168.1.10 192.168.1.12-192.168.1.255" with these remote ports instead only for 192.168.1.13, PBR shows an error.
Again, when for example device 192.168.13 is not listed in PBR everything works fine. I can access local and public server's addresses. But I also need to define all other devices in PBR.