regarding to VPN via NATed LTE WAN, you may use DrayTek VPN Matcher
https://www.draytek.com/support/knowledge-base/6125

I always forget about the "VPN Matcher Service" (since it's not available on my 2860). It doesn't seem to be completely implemented on the 2620 either (at least, not looking at the online emulator ) - though it does have "VPN and Remote Access >> Cloud VPN General Setup", which seems to be the beginnings of it.

(The emulator is running 3.8.13, so theoretically predates the feature completely)

But, in any case, doesn't the feature only allow cooperating Vigor Routers to establish LAN-to-LAN VPNs, rather than allowing general inbound access to CGNAT'ed clients?

(See also:[url] https://www.draytek.co.uk/support/guides/kb-lan-to-lan-vpn-matcher[/url] - since I was getting a "503" error on the DRAYTEK.COM link)

UPDATE - Now Draytek.com web site has come back online, I can see that the link was to 'howto' for a Host to LAN VPN. Still just VPN though... (or is it :?: :wink: )

Just a small update, it may not be the router that is the problem as detective hornbyp could be on the right track here. The SIM card is indeed from DNA in Finland and the original ISP supplied Huawei router is now doing the same thing by issuing a private IP to the DDNS service! So I'm beginning to think it's not a router issue but the ISP has changed something at about the same time I tried to use a new router.

hornbyp's link to DNA support suggested to try julkinen.dna.fi (julkinen = public in Finnish) for the APN address for port forwarding instead of standard data.dna.fi which I'd been using for many years without a problem. They say if you activated your subscription before December 2016 you should still use data.dna.fi *but* I have only just discovered that our account was recently upgraded to a faster speed without my knowledge and now I'm thinking this may have triggered the need for the new APN. The annoying thing is I don't have access to the SIM card for another few weeks as it's back in its remote location in Lapland and I'm 850km away in Helsinki. And of course, I can't VPN in to change the APN as it's blocked....

In the mean time, I've ordered another SIM card from a different provider and will try it in the Vigor2620Ln which I still have with me.

I shall update you when I have tried the new SIM card.

The new SIM card from a different provider works perfectly with port forwarding, VPN, etc. So the issue was obviously with the other ISP.

I will still try changing the APN on the old SIM card when I get access to it again but so far very pleased with the router and this new SIM.