depends what you mean by VPN ...
a true vpn will use protocols AH/ESP and udp port 500 AH/ESP are protocols not services in the same way ICMP/UDP/TCP are protocols
In PAT I have opened ports tcp 1723 and a few others.
I am able to get as far as verifying user name and password and then it is as if the server does not reply. In the event system log it says that the remote connection was not authenticated in the required time frame. Hope I am making sense