For the benefit of all, the secret is the following group of additional xml config elements
<interface name="IF-MdmAdm1" port="Port-WAN1"> <!-- phys port 2, to which ppp1 is connected -->
<subnet ip="192.168.1.254/24"/>
</interface>
<interface name="IF-MdmAdm2" port="Port-WAN2"> <!-- phys port 3, to which ppp2 is connected -->
<subnet ip="192.168.2.254/24"/>
</interface>
<interface name="IF-MdmAdm3" port="Port-WAN3"> <!-- phys port 4, to which ppp3 is connected -->
<subnet ip="192.168.3.254/24"/>
</interface>
<rule-set name="Modem 1 admin NAT" target-interface="IF-MdmAdm1" no-match-action="continue">
<rule set-source-ip="192.168.1.254"/>
</rule-set>
<rule-set name="Modem 2 admin NAT" target-interface="IF-MdmAdm2" no-match-action="continue">
<rule set-source-ip="192.168.2.254"/>
</rule-set>
<rule-set name="Modem 3 admin NAT" target-interface="IF-MdmAdm3" no-match-action="continue">
<rule set-source-ip="192.168.3.254"/>
</rule-set>
The above rules have all been added.
The whole config is very very long and has extremely longwinded copious comments in it since my memory is shot. I would be happy to post the whole thing though. Mind you, someone will tick me off ;-) for exposing IP addresses.
As mentioned before, the main LAN lives at IPv4 81.187.x.y/26 (no RFC1918, no NAT of any sort). The additional subnet objects set up addresses for the Firebrick of 192.168.n.254 on ethernet link (n+1) to each modem.
A ‘rule set’ is an entry-if-condition (match condition) plus zero or more rules plus an action to be taken if the entry condition is not met. Each of the rules inside it can have an if-match-condition of its own (not used in this case) and an action. The kind of action can be the usual firewall things but in addition it can modify packets, set up stateful flow (‘connection’) tracking, set up NAT table entries, place traffic flows under the control of speed shaper objects for rate limiting and probably other things that I forget.
If I had not been so full of drugs it might not have taken me seven years to work out how to do this. At one time it would probably have taken about ten minutes.