How can I hide my FastAPI port behind a SoftEther VPN connection?

[jnyum]

I’m currently running SoftEther VPN Server, FastAPI, and Streamlit on a Windows laptop in my home lab.
- FastAPI: running on port 8000
- Streamlit: running on port 8501
- Host laptop is connected to SoftEther VPN Server
- Internal laptop IP is fixed (static)

I want <HOST_IP>:8000 to be forwarded to Streamlit internally
(so accessing <HOST_IP>:8000 shows Streamlit)
Now I want to hide <HOST_IP>:8000 behind the VPN connection so that external users must connect through the SoftEther VPN before reaching FastAPI/Streamlit.

My question:
How should I configure SoftEther VPN Server so that:
Port 8000 (FastAPI → internally forwarded to Streamlit) is only reachable through the VPN tunnel, and
External clients connecting via the SoftEther VPN can access the service at <HOST_IP>:8000?
Any guidance on routing, L2/L3 bridging, or local bridge settings would be greatly appreciated.

Thank you :>

[solo]

https://www.vpnusers.com/viewtopic.php? ... 97#p102797
...= FastAPI = Streamlit =...