It may be a little different when you talk VM but the NAT function must actually very special support for vpn. IPSEC and pptp use their own protocols which is not the same as a port. The NAT function must support a function similar to port forward but much more restricted routers many times call this vpn passthrough. This is a option that either exists or does not you generally don't have to even turn it on.
I normally run in bridge mode but that is more because I am lazy that anything else. Makes port forwarding from the main router much easier.