RADIUS troubles with VPN and DHCP

Hi guys,

Long story short, I have a Draytek 2830 that is acting as a VPN server. It authenticates to an Win2016 RADIUS server that sits behind a Layer 3 switch on a different VLAN from the routers interface. There are static routes between router and L3 Switch.

When a computer authenticates, it successfully authenticates with the RADIUS, but the client receives an APIPA address (169x x x) and can only get access to the public IP of the router. everything else is non responding (public and private ip).

Does anyone know what might be causing this issue? I've spent way too much time on this.

Thanks in advance!