changing outgiong SNAT based on Requesting IP

Right now I have the following:

 

 

Any UDP 500 requests get snatted to let say 10.10.12.1 (public ip) so any UDP 500 traffic goes out as an IP i want the request to come back on.

 

 

 

I have another VS that listens on that IP 10.10.12.1 and forwards it to the firewall behind it.

 

 

 

The problem I am having is using a VPN client from the inside isn't working because I think it gets sent to the firewall and not to the requesting computer on the inside. What I would like to do is:

 

 

 

If the UDP 500 request is coming from internal subnet of 192.168.1.0/24 then snat it to 11.11.11.1

 

 

 

how can I do that with an irule