That’s odd – if you try to make a VPN connection (using GRE) when you have the otherwise-quite-good free ZoneAlarm installed… the connection just fails. SIlently. None of those little ZA popup things that one gets so accustomed to seeing. Turns out you have to add the target host as a trusted entry in the Firewall Zones. But it took Google to find that out.