I did find the MS Support Tools which has a pptpsrv and pptpclnt to at least be able to test the ports.
you need to make sure TCP port 1723 (for PPTP) or UDP port 500 (for IPsec) is open for the VPN to communicate through the firewall. You also need to open up IP port 47 (for PPTP) or IP port 50 (for IPsec). The IP port is not TCP/UDP or ICMP it's IP.
WTF does that mean? IP Protocol 47 (GRE) ? WTF. Urg. Networking is such complete balls.