Hi,
When I connect my 2830 directly to the internet (PPPoE on WAN2), so NAT at the client and RIPE on the Draytek, I am able to establish an IPSec/L2TP VPN.
If place the DrayTek behind another router, so NATting, it fails to connect. I have forwarded ports 500, 4500 and 1701 from my primary router to the Draytek.
Can anyone offer any advice (save not using an additional router? )?

Don't you need protocols 50 + 51 (not ports) as well? ... as in http://windowsitpro.com/security/q-what-firewall-ports-should-we-open-make-ipsec-work-through-our-firewalls

Thank you for the fast and complete answer. I guess that's now out of the question with the BT Homehub. I have enabled passthrough but that is more for outbound AFAIK.
I guess that leaves me with LAN-LAN with the Draytek behind the [homehub] calling out. I can disable the connection when I don't want it.
Thanks again!