IN the DHCP scope use the PA address as the GW that way what ever address the machines pick up they will go through the PA.

What rule are you using on the PFsense, I have one here as a test box and Ill try it and see if I can match it on a Draytek

I tried that, using the PA external Address as the gateway. But as it was on a different IP range it kept on changing it and not actually setting it to what it should be. I can try changing the DHCP to be in a similar range to the PA external address if you think that would help?

I'll get the details of my Pfsense rule and let you know.

Well I managed to get it doing what i need it to.. sort of.

By ticking the " Change default route to this VPN tunnel" under the LAN to LAN profile it is now pushing all the traffic back through my tunnel to HQ where the firewall is filtering what they are allowed to do.

Only 1 little problem however is that now it doesn't seem to resolve host names. If I plug in the IP address of a website then it is fine. But trying by URL for instance does not.

youll probably find its looking at your ISP DNS servers...
GO in to LAN settings and FORCE the Draytek to use what ever you like