Would it be an option to go ipsec and just set up some good old open source openvpn clients for everyone?