Old thread but might be worth adding to it for reference..

I recently set up a draytek with a Vodafone consumer sim (no public ip) and got ipsec vpn working ok. Actually I set up the vpn the same way as i've done with Three Business ones before. You have to use aggressive mode on the IKE phase and set a local id. Lack of public ip doesn't seem to matter.

Finding a 4g dongle that works across draytek models 2860, 2760 and 2820 is the hard part!

Easier to buy the 'L' models if you're buying a new router.

no doubt, but they a big step up in price and usually in our case the 3g/4g is only needed for a couple of months while waiting for a line to be installed. i'm in the middle of trying various 4g dongles at the moment. zte mf823 = no good. e3372 next.