If i am not wrong, there’s no GUI way (cockpit or NethGUI) for add DNAT or SNAT to VPN connection.
As @filippo_carletti stated few months ago…
http://shorewall.org/netmap.html
is the answer for configure it, but as far as i can see, netmap feature for Shorewall currently cannot be configured on any kind of VPN (IPSec, OpenVPN RoadWarrior, OpenVPN Tunnels).
Or maybe i did not searched enough on Docs…