We recently bought a second Draytek Vigor 2930. It has firmware v3.2.2 installed, whereas our first Draytek is running 3.2.1.

The new one is being weird: I've turned off "Allow management from the Internet" (and rebooted) but it still responds to https on port 443 on its public IP and lets me login to the web admin UI. The HTTPS port for management is set to 4431 but it still responds on 443 on both internal and public IPs. I have opened ports 80 and 443 inbound for forwarding to a PC on our LAN but 80 isn't allowed through and 443 hits the management UI.

Our old 2930 running v3.2.1 doesn't have any of these strange issues.

And I've noticed that the current firmware offered for download on this site is 3.2.1, not 3.2.2.

Should we downgrade to 3.2.1 - is the newer version known to be unreliable?

Try
Go in to VPN and Remote Access,
Go to Remote Access Control

Untick / disable SSL VPN Service.

Reboot
sorted