It’s relatively simple. You can forward the port as usual, and you just need to make sure that you have proper routes in both ways and correctly configured firewalls. The tricky part is when the target network with server has different default gateway, but it might not be a problem in your case, if PC 192.168.111.254 has hapAClite as default gateway.
So basically you need to tell RB2011UiAS that 192.168.111.0/24 is reachable behind 192.168.110.250, which can be done in “/ppp secret”, parameter “routes”. Then forward port using dstnat to 192.168.111.254:443. Or you can skip it and only use dstnat on both RB2011UiAS (to 192.168.110.250:443) and then also on hapAClite (to 192.168.111.254:443).
Return path should just work, if hapAClite is PC’s default gateway and if you make VPN default gateway for hapAClite. If any of this is not true, you can either add srcnats, so that the connection would look as coming from 192.168.110.1 and 192.168.111.1(?) respectively, which would make replies take the correct way back. You’d lose original source addresses. Or you’d need to mark forwarded connections and then use route marking, to send them back the right way.
You can find some inspiration in this thread (it’s about forwarding whole IP address through tunnel, you don’t that, routing the replies back is the same).