Switch – Cannot access SWITCH thru VPN

You can set the LAN to LAN tunnels using differing IP addresses as you note, and as long as you do not add a route between the subnets they will not be able to communicate. Under your dial in settings, disable RIP, and do not add a static route.

The user guide section 4.96 gives a good start.

You cannot, add a WAN port to a VLAN using the GUI. However, you can set up your VLANs internally and then add port redirection from the WAN ports to forward to your VLAN'ed ports. This will ensure that the connections on your LAN to LAN profiles stay internal to the expected subnets. This is in section 4.3.1

Look at the sections I noted above in this document:

http://www.draytek.co.uk/support/userguides/Vigor2920%20User%20Guide%20V1.01.zip

You need to get a grip on where you're doing routing between VLANs first. If a router you have no control over is the default route for devices on 1.0/24 then you're going to have a tough time sending traffic over to the device be it L3 switch or router to get your traffic over to 5.0/24.

Now... because you have both phones and data on the same LAN now, you should be able to create a VLAN, call that VLAN101 for example and assign all existing ports on the switch you CAN manage to that VLAN. Now... create a second VLAN on the switch, let's call it VLAN105 and assign whatever port you want to that VLAN. If you assign that VLAN to an access port that has an unmanaged dummy switch, then all downstream devices will jump to that VLAN.

Just understand that each VLAN behaves like a separate switch, it has different properties and traffic will not pass from one VLAN to the other unless a L3 device is in place to permit that. Back in the day you created a trunk to a router, and a router performed this for you. Today even cheapo switches have L3 capabilities and can perform inter vlan routing. You need to look at the specifications of the switch, it sounds like your "router" can accept a trunk if it supports VLANs.