Remote desktop services (RDS) Gateway Server

Seeing VPN users in RD Gateway Manager simply means their RDP clients are actually using the Gateway. RD Gateway doesn't automatically classify a connection as “internal” just because the client has a VPN connection.

I would first inspect the RDP client's Gateway configuration:

Remote Desktop Connection

→ Advanced

→ Settings

Check whether the Gateway is always forced or whether Bypass RD Gateway server for local addresses is enabled.

Microsoft's RDS deployment configuration exposes that bypass option explicitly.

Then, from one VPN client, verify whether it can directly reach the Session Host:

Resolve-DnsName rdsh01.contoso.com

Test-NetConnection rdsh01.contoso.com -Port 3389

If DNS resolves to an inaccessible address, the VPN doesn't advertise the correct route, or TCP 3389 is blocked between VPN clients and the Session Hosts, the client can't use the direct path and the Gateway is expected.

So there isn't necessarily a problem with RD Gateway. First determine whether direct RDP connectivity from the VPN subnet exists and whether the client is configured to bypass the Gateway for local addresses.