Hey Si, yeah, it's not easy done, even getting the connection to work was fun, never mind getting the data flowing in both directions on the tunnel. It's working at the moment, but it's even more fun trying to get the VOIP to work down it. We had been advised, after a couple of weeks working on it, to try to use two tunnels, one for data and one for the voip, as each uses a separate VLAN, but I since found that we can't point two IPsec tunnels at the same public IP as the encryption can't handle it, it must clash in some form or another. So then I tried adding the VOIP VLAN IP as a second proxy in the IPsec tunnel itself with a static route in the virtual router in our firewall, again, no luck. The DHCP just isn't being picked up properly by the VOIP phone on the other end, and also ends up turning up in the leases of the data VLAN DHCP scope on the server.
Fun and games!