gcp wrote: I'm a bit confused why you are trying to connect to your VPN internally. That just won't work.

Actually it will, and it does. You can encapsulate your internal wifi traffic via the Draytek's VPN. For those who don't trust WPA2. This is often used in Government sites, with Cisco kit.

It can also be advantageous over standard ethernet, if you don't trust a network segment - say in a shared office space or residential building.

Draytek support this:

http://www.draytek.co.uk/support/kb_vigor_vpnoverwlan.html

I can confirm it works on the 2820, and in 3.3.4 you can force VPN as a requirement for wifi connection.