Ok, so following on from https://superuser.com/questions/923747/vpn-ip-forwarding-and-nat/925570#925570 I have what may be a really stupid question to ask, but if all you need is access to specific ports, like http/https have you tried SSH Tunneling? It's much easier than setting up a VPN. Ultimately you ssh from one machine to another, and then have the target machine establish an onward connection to something, and have that connection forwarded back to your local machine.
So say you can access the public (DMZ) part of a machine A.A.A.A which can in turn access a private machine B.B.B.B, and you want to connect to a HTTPS service (port 443), and assuming your desktop already has a service running on 443, so you're going to have the service listen locally on 4443.
ssh -L4443:B.B.B.B:443 adminuser@A.A.A.A
Then login, and run up a local browser and go to https://localhost:4443 or if you like, add an entry to your hosts file, sending 127.0.0.1 to intended.vhost.name and then go to https://intended.vhost.name:4443/
If you REALLY need a vpn, then...
Can you ping both the IP address of the local and opposite sides of the tunnel from your laptop? Can you ping a different machine on the opposite site network? If you can't try tracerouting it, and see if you get an echo back from the local and remote sites of the tunnel (if not, your routing is wrong).
What are the various network addresses? You might try telling route, which device you're expecting it to send traffic on, otherwise it has to be able to infer.
I was re-reading this and thought I'd add some notes that might make it easier for anyone trying to follow what I suggested:-
To make it possible to access https://intended.vhost.name:4443/ and have that tunnel, you need to add an entry to your hosts file. On linux thats /etc/hosts on Windows it's c:/windows/system32/drivers/etc/hosts Either way you'll need admin privileges to save the file (sudo for linux, open notepad as administrator on windows). Then add the following line:-
The other thing I mentioned was setting up a listening tunnel on a machine, which can punch a hole through a firewall. As discussed earlier running ssh -L4443:B.B.B.B:443 adminuser@A.A.A.A will open an ssh terminal on machine A.A.A.A, and while so doing, will tunnel traffic from local (the -L) port 127.0.0.1:4443 to B.B.B.B:443 (the 127.0.0.1 is implied). Assuming your local machine is C.C.C.C and you want to open port 4443 on that IP, for other machines to access you can do this:-
ssh -LC.C.C.C:4443:B.B.B.B:443 adminuser@A.A.A.A
It's worth noting here that if you add a -T parameter, you change the behaviour of ssh, to open the ssl connection, then the tunnel and not start the terminal within it.
When I've done this before, I setup a user on the local machine (lets say tunneluser) and create a set of ssh keys for him in ~tunneluser/.ssh then ensure the file ~tunneluser/.ssh/id_rsa.pub is listed in the remote machines ~adminuser/.ssh/authorized_keys then the ssh connection will start without prompting for a password. As a security feature, you can setup tunneluser remotely, with /bin/false as his shell (in /etc/passwd) then the connection will fail if you miss the -T parameter.
A simply way to implement that is to include it in a script in /etc/init.d that is run after networking (usualling in rc3.d). I would suggest a layer of security though (avoid running it as root) using
sudo -u tunneluser "ssh -T -i/home/tunneluser/.ssh/id_rsa.pub -LC.C.C.C:4443:B.B.B.B:443 tunneluser@A.A.A.A"
Note though, that if the IP you want to listen on (the :4443 listed above) is a 'privileged port' (ie it's amongst the range normally used by system services), you'll need to run ssh as root, to get permission to listen there.
Any window user then need simply access https://C.C.C.C:4443 and they would see the site that was on https://B.B.B.B:443.
If the machine at C.C.C.C doesn't have a service blocking :443, use that instead of :4443 and https://C.C.C.C would be equivalent to https://B.B.B.B
As an aside, if the intention is reversed, say you're on a machine with access to C.C.C.C you want to punch a hole through the DMZ via machine A.A.A.A such that users that can access B.B.B.B, can access C.C.C.C via tunnel, without being able to access it directly, you use -R instead of -L (and the listening socket is at the Remote, rather than Local side of the tunnel). I include -T to show how it's used.
ssh -T -RB.B.B.B:4443:C.C.C.C:443 adminuser@A.A.A.A