VPN masquerading

i have read lots of newsgroups and howto's and until now have not found a definitive answer to the question: how do i forward the necessary protocols (not the ports, for pptp or ipsec) to a masqueraded vpn server, or is is possible at all using susefirewall2 and iptables? most people seem to agree that it is indeed possible using iptables without susefirewall2, but event then i have not found a working solution up to now. if anybody knows a patch for the susefirewall2 script or the necessary rules to put in the custom script which is called at the end of the config file, please help me out. anything that works is appreciated... thanks in advance alex