Adding to Alex's notes...
The VPN responder MUST have a public IP address on its WAN interface.
Just because DynDNS registers the address in use does not mean it is public and routable.
If the address assigned is in a private range, then this will not work, even with DynDNS.
Common private ranges are:
10.0.0.0 - 10.255.255.255
100.64.0.1 - 100.127.255.254
172.16.0.0 - 172.31.255.255
192.168.0.0 - 192.168.255.255
Even if the WR11 SIM provides a public IP address, you need to ensure that IPsec services are allowed. Some mobile network operators will block certain ports and protocols. Check this with the network operator.
If either of these are the cause, there is nothing Digi Support can do to help.
Ben - Digi Support