Trouble blocking VPN users from accessing my LAN

Greetings!

I'm having some issues with creating firewall rules to prevent VPN'd users from accessing parts of my LAN, and I'm hoping someone is able to help.

I have OpenVPN installed and set up to provide 17.16.0.0/24 addresses to my VPN'd clients. My LAN is 10.0.0.0/8. My clients need access to exactly two IPs on my network:

- My internal DNS (let's call it 10.0.0.10) so the domain of my webserver resolves, and
- My webserver (let's call it 10.0.0.20)

Other than that, I want everything else to be inaccessible.

None of what I have tried so far has worked.

Any help would be much appreciated.

Thanks in advance,
Jay