Ok, I may have to eat some humble pie here. I'm back to experimenting with this, but now I only get the above message when there is indeed a rule that references the VPN subnet. Either that suddenly changed or the subnet was indeed referenced in a rule and I repeatedly didn't catch it. However, there is still a lingering issue for me here. Consider this firewall rule:
The rule includes the VPN subnet in the list of sources but alongside another network. If I change the VPN subnet, I get the "firewall rule will be removed message", and if I follow through, this rule is deleted. It does not delete the subnet from the rule or update it - it just bins the whole rule. I tried defining the VPN subnet as a CIDR entry as well as via GPO, but the result is the deletion of the firewall, rule even if the deletion wrecks connectivity for other subnets in the process. That seems poorly thought through to me unless I'm missing a piece of the logic here. Especially if the VPN subnet can't be changed without this consequence. Is this expected behaviour? (I know the workaround would be to skim through and pluck the VPN subnet from all firewall rules first and then change it, but this behaviour still doesn't seem like a good process. It doesn't even specify which firewall rule it is going to nix, which would be more helpful at least)
