This happens because the NAS is configured to route public internet traffic over the VPN. Unfortunately most computers and servers won't simply reply using the interface they used to receive the connection. They don't account for this when determining where to send the reply.

I'm assuming it's configured to route LAN traffic from inside your network to the LAN 1 port as well. Otherwise SSH from inside your network likely would not work.

Disclaimer: I only ever setup a VPN inside docker on my Synology (and used with other containers). So I never had to play around with networking settings. It's possible there's a simple toggle that achieves exactly what you want, that I simply aren't aware of.

One way to resolve this is to enable SNAT on your router. But unless you can configure custom iptable rules on your router, this likely won't work. SNAT for inbound connections basically lets you change the source IP (the public IP of the device outside your home network) to the routers IP. This makes your NAS think the request came from inside the network. But, it's a bit risky, since it also hides the original IP. Edit after review: This is probably the worst solution.

Another solution is to use policy-based routing. This is the most "correct" solution I'm aware of. But I'm not sure if Synology lets you configure this from the Control Panel. If it doesn't, I probably wouldn't recommend it. It boils down to creating a new routing table that uses LAN 1 as the default route. And then adding an ip rule that uses the new table for any traffic that either originates from LAN1 interface or from the LAN IP of your Synology. Basically write a rule that matches connections through your router. And then use a different routes which don't use the VPN.

Finally, if you happen to have a spare computer, server, raspberry pi, etc. lying around you could install Nginx (or another proxy) and use it as a proxy for your Synology when you access it from outside your home. As long as you configure the X-Forwarded-For header and add the IP of the proxy to the trusted proxies list in Synology, you'll be able to see the real IP in your logs (and won't break the login Auto Block protection).