For anyone else with strange issues, this thing is a whiny baby, and firewall/routing fully finishes after the dial-up connection is established so will not pass data, although it shows a WAN IP.

Setting AT+QCFG="nwscanmode",3,1 to AT+QCFG="nwscanmode",0,1 (auto scan type) delayed the connection ...