VNC in a Windows Environment, Servers behind Router/Firewall

[Ryan Small]

Presently evaluating using VNC so that employees can connect to their
office computers from their home.  ALL computers (home and office) are
running Windows 2000 Professional; however, the computers at the office are
behind a router/firewall.  Additionally, because this is corporate use,
would like to use an SSH tunnel for security.

The basics (as I understand them):

1) Router/Firewall to have a static IP address
2) Office Workstations to have a static IP address
3) The router/firewall is to be configured to use "Port Forwarding" to
direct the incoming connection at the router to specific workstations
4) Use of an SSH tunnel to provide a secure environment.

Implementing the SSH tunnel is the task at which I am confused:

  -Software to use for SSH tunnel - OpenSSH, Zebedee,
http://www.cygwin.com
  -How to configure the SSH tunnel at both the server and client
  -How an SSH tunnel differs from a Virtual Private Network (VPN)

     Thanks for your assistance,

        Ryan Small