At least for PPtP VPN I also needed to allow GRE protocol in the firewal:
config rule
option target 'ACCEPT’
option _name 'pptp’
option src 'wan’
option proto 'tcp’
option dest_port ‘1723’
config rule
option target 'ACCEPT’
option _name 'gre’
option src 'wan’
option proto ‘47’