Hi,
My test topology is:
MT6000 with v4.8.1 (snapshot) and v4.8.0-op24 (beta) as the test router, and the policy rules are similar with your screenshoot:
When MT6000 enabled the VPN tunnels in policy mode, my phone is able to access the MT6000 GL GUI and the Web server by MT6000 WAN IP + port.
How to reproduce this issue about unable to access the MT6000 LAN clients by WAN public IP?
If possible, could you please share the MT6000 with us to check through GoodCloud?
Please PM me the MT6000 MAC address and Web UI login password.