First make sure port 1723 is open on the machine you want to connect to
On the router
using
tcpdump -i eth0 host WINDOWSIP and not port 22 and not port 80
on the router (where eth0 is the INTERNAL interface) try to make the connection and look at the data.
If you're sending and recieving lots of packets but the final ACKs aren't completing from the remote machine
Check if ip masquerading is on
/etc/init.d/ipmasq start
If there's outgoing traffic to the remote machine but none coming back
make sure ip forwarding is allowed
echo "1" > /proc/sys/net/ipv4/ip_forward will allow outbound vpn connections.
If you do that make sure
echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
as well