Blocking ports on VPN server

I have a Win2K server, a member server on a mixed network of NT and Win2K, whose only purpose is to provide VPN server via public IP address, so users can logon to network via dialup ISP. Using IP filter under TCP/IP Advanced what ports must I leave open for a fully functional VPN?