iptables -P FORWARD DROP

iptables -A FORWARD -i <if_inet> -d <pptp_svr_ip> \
-m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A FORWARD -i <if_inet> -d <pptp_svr_ip> \
-p gre -j ACCEPT
iptables -A FORWARD -i <if_inet> -d <pptp_svr_ip> \
-p tcp --dport 1723 -j ACCEPT

iptables -t nat -A PREROUTING -i <if_inet> -p gre \
-j DNAT --to-destination <pptp_svr_ip>
iptables -t nat-A PREROUTING -i <if_inet> -p tcp \
--dport 1723 -j DNAT --to-destination <pptp_svr_ip>