Customer VLAN Outbound NAT with Site-to-Site

[BrianD]

We have several customers who have a VLAN behind our GAIA (latest version). In order for those servers to reach the Internet we have to create an rule that states all traffic from this VLAN Subnet, to any destination, goes out of a certain public IP address.

However, when a customer needs a site-to-site tunnel from their office to their VLAN subnet, the traffic on the tunnel is also being NAT'd due to the rule stated above.

How can we specify that the NAT rule for Internet access only applies to traffic designated out of the WAN interface (to the Internet) and not to devices across their site-to-site tunnel in their corporate network? 

Thank you!