See here: http://support.apple.com/kb/TS1629
OS X Server supports two VPN types. PPTP and L2TP. See the list for the associated ports. Please note the type or protocol required on the port. PPTP uses TCP and L2TP uses UDP. You only need to open the ports for the one you want to use.
To run a public VPN server, you need to do the following:
1. Give the gateway either a static external address or a dynamic DNS name. In the latter case, you must run a background process to keep the DNS record up to date when your IP address changes.
2. Give the VPN server a static address on the local network.
3. Forward external UDP ports 500, 1701, and 4500 (for L2TP) and TCP port 1723 (for PPTP) to the corresponding ports on the VPN server.
4. Configure any firewall in use to pass this traffic.