please exclude the connections to the local subnet from the tunnel and the lookups to the .local zone. That would make sure that the timemachine backup on a local NAS would still work, as well as the connections to the AFP shares...