Corporate VPN service with separate nets for different users/groups

Hi

We are going to host some services for customers with separate private networks for each customer. Each customer will need one or more users.

I have to put up a VPN solution, and I would like to use something that will work on "any" platform, easily, without too much installation/configuration. I feel PPTP is a good option since the "agent" is included on most platforms. We have a firewall/router on a Debian Linux server, and I'd like to extend it's services to include the VPN service. It has access to all nets, so it should be easier to get that to work.

My firewall/router has four interfaces, but only three of concern. eth0 is the outside, eth1 is the inside and eth2 is DMZ. I use proxyarp to get traffic from eth0 to eth2, with iptables filtering. eth1 has three internal nets in the 192.168.* series. The new nets I want to use for customers will be separate VLAN's on that interface with 10.20.x.* addresses. The firewall/router will of course have an IP in each of these (typically .1).

The big question is how to set this up? Can pptpd be used? Should this be done on a separate server?