Is there some other benefit of having separate VLANs? You seem to be trying to overcome the segmentation they’re designed to implement, and the main reason for having them. Why not get rid of the VLANs and just use firewall address-list membership to route traffic over the VPN? This is how I have my network configured and no devices have any trouble with local network access whilst they’re connected to the internet through the VPN. I used this guide for a simpler configuration: http://forum.mikrotik.com/t/nordvpn-ipsec-ikev2-killswitch-for-ros6/144817/1