2xOPNsense and static routing

[OPNsense4ever]

Hello,

I have a machine with several VMs and I am using OPNsense to control their access to the outside world. I also have a regular OPNsense server that has a VPN server on it. What I am trying to do is get access to the VM's internal IPs (10.2.0.2 for instance) via the VPN, but the default route for the servers is the OPNsense VM (172.16.1.1) so packets coming from the 10.1.0.0/24 get in, but the return goes through the OPNsense VM. I set a static route on the OPNsense VM to route 10.1.0.0/24 via 10.2.0.1 (it has an interface that can talk to this server), but I get denied at "Default deny rule". I've set various Firewall rules and I can get ping to work, but no other packets. They all hit the same "Default deny rule". I've tried the "Bypass firewall rules for traffic on the same interface" thing, but that doesn't help.

What am I missing?

Thanks!