IPSEC VPN from DrayTek3900 to OpnSense with 2 Subnets

[sc0ttjm]

I tried to find a guide on how to setup an IPSEC VPN between a DrayTek Vigor 3900 and OpnSense but couldn't find one anywhere.

I eventually worked it out and got it working which is great (if anybody wants to know how I did it, just let me know), BUT then I realised that the DrayTek has 2 x Subnets that both need to be accessible from clients on the other side of the OpnSense firewall.

I found this guide on the DrayTek website: https://www.draytek.com/support/knowledge-base/5428#linux

If you look at "Case 2: Vigor3900 has two local networks while the VPN Peer has one" This is Exactly my scenario.
I've followed this guide but I can only connect to devices on the first subnet and not the second.

The only thing I think of is, could it be because of the security used on the IPSEC tunnel as in the images on the page the connections are green and mine are purple, which means they are IKEv2 Tunnels?

This is my setup (IP's Changed)

DataCentre
Make/Model   OpnSense Business Edition
LAN Address   10.0.3.0
LAN Subnet Mask   255.255.255.0
Router IP Address   10.0.3.1
Public IP Address   1.1.1.1
VPN Profile Name   IN_Site_1
Call Direction   IN
IKE   IKEv2
   
   Site 1
Make/Model   DrayTek Vigor 3900
LAN Address   10.0.1.0 & 10.0.2.0
LAN Subnet Mask   255.255.255.0
Router IP Address   10.0.1.1
Public IP Address   2.2.2.2
VPN Profile Name   Out_DataCentre
Call Direction   Out
IKE   IKEv2

Result, Tunnel up and I can ping devices on 10.0.1.0 from 10.0.3.0, I can ping devices on 10.0.3.0 from devices on 10.0.1.0, I cannot ping devices on 10.0.2.0 from 10.0.3.0 and vice versa.

Can anybody help?
Thanks

[banym]

Can you please post some screenshots of your phase2 configurations and the rules on IPsec interfaces of both sides.

[sc0ttjm]

As requested, please find attached images showing my setup on both the OpnSense and DrayTek Routers:
I can't find how to display them in the post (is there a guide on how to use this forum?)

[sc0ttjm]

HELP - I tried changing both Phase 2 connections from the default option to routed and now I've lost connection to the box completely, I've seen this elsewhere in the forums but I can't find how to fix it again other than reverting to factory defaults which I really don't want to do.
Please can you help?
Is there a way to undo what I did from the shell?

Thanks in advance!

[banym]

Yes you can revert to a backup configuration or an earlier configuration state using gui or shell.