I went back and looked at the WAN rule before I was going to screenshot it and I saw my mistake, under destination I had manually put in the WAN IP address. I changed it to "WAN address" and its working now, so thanks for that.
I'm still having issues with getting the VM connected. I've pretty much left everything default with regard to this, I'm not sure if I need some NATing rule?
I had a look through the doc you send me, I appreciate that in a normal setup using a VPN would be better but this is purely to separate my VM network from my home network so i'm not fussed about the security hole of having the webui accessible from my home network, i'll never be accessing it from public address space.
Thanks