If you’re not using LDAP as account provider, you have 2 IP Addresses in your server.
The first is the actual ip, the one you set into network configuration (Green interface)
The second is the ip of the container, who’s the “effective” account provider of the server, used via LDAP from NethServer. https://docs.nethserver.org/en/v7/accounts.html#samba-active-directory-local-provider-installation
which firewall may not be so much “permissive” to VPN subnet.