Hello people,

Before submitting this, I have trawled through the posts, but cannot find anything that would help me or is relevant to my problem.

I have a Draytek 2830. It is connected to a static public IP on a FTTC lease line in a business park.
It is connected to a Netgear switch (FS728TP) on LAN port 3, with an IPv4 address of 172.16.95.1
The Netgear switch has a LAN address of 172.16.95.2
I can connect to the Draytek router from any remote location, but I want to be able to connect to the switch to be able to configure it remotely, as it is a long way away from me.
The switch is connected to a Firebrick (FB2700), from which it gets a VLAN tag of 3000 and passes this through the switch to the Draytek. Tagged in on port 28 and untagged out on port 16
So, the connections are; from port 1 of the Firebrick to port 28 of the switch; from port 16 on the switch to WAN2 on the Draytek, with the WAN2 port setup on the Draytek set to PPPoE with the username and password as set on the Firebrick. LAN 3 port on the Draytek is connected to Port 18 on the switch , with port 18 also untagged out on VLAN 3000. Both switch ports have a PVID of 3000.
So, I am trying to get to the switch's 172 LAN. I can get to the Draytek, via its WAN IP, but do not know how to setup a connection to the switch. Do I need to create a VPN tunnel to it? If so, how?
Do I need to link the WAN and LAN ports on the Draytek so that I can pass traffic through them, from public IP to the 172.16.95.0 subnet and access the switch on 95.2? Again, if so, how?
Any help would be appreciated.
I know this is rather an unusual situation, but the company for whom I work has been trying to get a remote ability to internal switches for some time and my predecessor also could not solve it. I would like to be able to, with your help, of course.
Please ask for any other information, if needed. I will draw a logical topology of the setup and post it here tomorrow evening 22-03-2018

I'd create a remote dial in user using L2TP over IPSEC, so that you are on the draytek's subnet, and that would be like being plugged into a spare port (in your case), so you can access everything else as if you were local.

In the IPSEC general, create a pre-share key.
Then create a remote user, as an L2TP, with must encryption, the helps can be googled, and once you are in, you should be able to work the rest out for yourself, as far as the switch goes.