This is a much asked question and under 1.2.x the answer was; it was not do 
able. It was my understanding, that the improved NATing of 1.3 would allow 
One to setup and use windows VPN in a double NATed network to connect 
to an outside VPN server?

I have the following:

Internet--->65.121.A.X/29--CISCO--->192.168.A.X/24--->monowall--- 
>192.168.B.X/24--LAN.

Currently I see on the firewall log.
WAN 192.168.A.1 192.168.B.121, type unreach/host ICMP
192.168.A.1 is the internal IP address for the CISCO router
And 192.168.B.121 is my workstation


Questions:
Can 1.3b2 do this? 
What settings/rules/NATing am I missing?