Can’t connect to vpnd from behind an Airport Base Station

I have an Xserve running Mac OS X Server 10.2.4. One ethernet port has a live internet IP address, the other is connected to a private 192.168.x.x network. The server is performing NAT and transparent proxying for port 80 using squid.

It’s also set up with the VPN server for PPTP as per the AFP548.com article, and it works great… except for when I try to establish a connection from behind an Apple Airport Base Station using Internet Connect.

To clarify:
– If my client has a public internet IP, I can connect.
– If my client is using NAT behind the “Internet Sharing” feature of OSX, I can connect.
– If my client is using NAT behind an APBS, I can NOT connect.

Lots of investigation shows that GRE packets are going from my client to my server, and a response is being sent by the server, but the response never comes back through the base station to my client.

It’s not a simple problem with vpnd and NAT because I can use other NAT systems.
It’s not a simple problem with the APBS because it’s (reportedly) compatible with other PPTP servers.

Any solutions / suggestions would be appreciated.