I have an ASUS AC-5300 router running Merlin. The router is connected to the T-Mobile Nokia Gateway through it's ethernet port. All of my devices are connected to the ASUS router. On the ASUS router, I have a VPN connection to TorGuard VPN. I have the ASUS router configured to send outbound traffic from my Channels DVR server that is destined to 104.21.71.35 or 172.67.142.202 through the VPN. On the TorGuard website, I have my account setup to forward TCP port 8089 through the VPN to the ASUS router. The ASUS router is configured to accept inbound TCP port 8089 and forward the traffic to the Channels DVR server. In addition, the ASUS router is configured to send the response traffic associated with the inbound 8089 port back through the VPN. All other traffic, including all other traffic from the Channels DVR server, passes through the normal default gateway, the T-Mobile Nokia gateway.
I cannot get any more specific than this because your VPN and router may be different.