if you look at the documents section of DIGI website
There are a number of diffrent ways from VPN using IPsec / OpenVPN or using GRE
this all depends on the type off access and what you are trying to connect to.
as the hq has a dynamic address then HQ would make / initiate the connection.
if the address are public you could use dynamic dns to be able to find the hq ip address from the remote site.