Consider the following:

I have a Windows XP machine behind a NAT firewall that I'd like to connect to remotely (e.g. from a client's site). I was originally going to use Remote Desktop for this, but it only allows one user to be connected at a time (remote or local) which is no good. So I thought of using VNC. The trouble is that the data in VNC is transmitted in the clear, so I need to tunnel it through another protocol. SSH clients for Windows cost serious money, and I was looking to do all this for free.

So, is there a way I can set up the Win XP box to act as a VPN server, then connect to it from the other end using a VPN client, then run VNC? Would prefer to stick to using stuff that is native to Win XP/2000 rather than having to install things, as sometimes I don't have local admin priveleges at the remote end. The VNC client is OK as it's just an executable to run and doesn't need installing as such. Which ports would I have to open up on the firewall?

The goal here is to allow remote access without opening up a huge bunch of security holes...