VPN-Website problem

I have numerous web sites on a IIS 5 server (W2K) with some of them holding
very private information.
The IIS server is also a W2K DC behind a NAT router.
I have set up most of the remotes with MS PPTP VPN Clients (MS-ChapV2 only)
for access to the IIS private sites.
I have used ip address restriction on those private sites to use the
internal private on-subnet address range that the RAS server gives out to
dial-in VPN clients.

I tested by using a dial-up ISP and then instantiating the VPN, wherein I
notice that I am restricted from access.
A review of a restricted Web site log shows that IIS thinks the soure
address is the registered ip address that the ISP issued my PC, instead of
the ip address issued by the VPN server. The client is XP Pro.

Anyone have any ideas on this?

Why does the IIS log show the ISP's address and not the VPN's address?


I know that the private web sites could have internal ip address (private
range) and thus only allow access via the VPN.


Thanks