A VPN could be built with
gre and
PPTP, but this is not generally done when you use ESP, one of the IPSEC protocols.
Way back in 2004 on bsdforums.org I assisted Dachozenone with a pf.conf for a VPN using ESP.
http://74.125.77.132/bsd?q=cache:tsI...&hl=en&strip=1
The secret is to allow
enc0 traffic and UDP port 500.