I don't know about Port 443, Peter. I'm not that "into" the technology of routers. However, when i run a "Shields Up!" test, it shows port 443 as fully stealthed. Indeed, it shows all ports thus (well, up to the limit of "standard ports").
ZoneAlarm tells me about any attempt to access any of the higher-level ports - the only programme that ever tries that is Skype, and it gets blocked.
I don't know how the Draytek does it - I just read the instructions!
I set up the two routers (Essex and Norfolk) to connect as a VPN, then I
remote-desktop to the Essex desktop machine from the laptop's IP address on the Essex network. It seems to work fine.
The only "gotcha" was that the Norfolk machine's IP address series had to be different from the Essex one. For the brief period they were both 192.168.1.x it was hard work trying to make things connect.