Further experimentation.

I switched some of the VPNs to WAN2. Again any Policy Route makes the VPNs inaccessible.

Finally got this working. No idea if it's the correct solution but it works.

What I had to do was add all the VPN connections as individual Policy Routes in the Policy Route table before the main Policy Routes for WAN priority.

To be honest I would regard this as a serious failing of the Draytek software for two reasons.

1. When you define a VPN you have to remember to specifically add its associated Policy Route.
2. Surely there should be a simple setting when you have multiple WANs to define their priority. No policy routes or load balancing or all that melarkey just use the WANs in this order. Either that or be able to define a default WAN.

Roughly these are the Policy Routes I have now:

1. Any, VPN 1, 192.168.xx.1 - 192.168.xx.254, 192.168.aa.1 - 192.168.aa.254
2. Any, VPN 2, 192.168.xx.1 - 192.168.xx.254, 192.168.bb.1 - 192.168.bb.254
3. Any, VPN 3, 192.168.xx.1 - 192.168.xx.254, 192.168.cc.1 - 192.168.cc.254
4. Any, WAN 2, 192.168.xx.1 - 192.168.xx.254
5. Any, WAN 1, 192.168.xx.1 - 192.168.xx.254
6. Any, WAN 3, 192.168.xx.1 - 192.168.xx.254

Having given up on the DDNS and switched to a Server based app all I need to do now is work out why the Wireless performance is so appalling.

Rapidly losing faith in Draytek.