Master Networkers Grashopper needs help.

Here's my design, I missed a step I know. So it's flawed. Which is why I
need your help.

3 VPN Routers.
1 = MAIN
2 = DMZ
3 = PH-01

172.16.7.1 = MAIN internal
192.168.1.5 = MAIN external.

{MAIN external side Plugs into DMZ's internal side}

192.168.1.1 = DMZ internal
199.10.38.42 = DMZ external. (changed to protect the innocent)

{VPN connection made from PH-01 to internal side of MAIN Through DMZ. Up and
working.}

192.168.9.1 = PH-01 internal
216.10.137.78 = PH-01 external. (changed to protect the innocent)

OK First off 'Why did you do this' they always ask.
Two locations need to be linked. MAIN location is sharing their public IP to
the public (wireless hotspot.)

Here's the router I forgot about.
It's actually a Windows 2003 server, and it's external is plugged into MAIN.

192.168.8.1 = Windows 2003 server internal
172.16.7.4 = Windows 2003 server external.

I meant to vpn from PH-01 to the server but I only VPN'd to MAIN.

PH-01 is a FVS328 netgear router, (so are all the others)

So here's my question...
How do I allow traffic ONLY from PH-01 to the INTERNAL side of my server.

Can I VPN in directly to the server via the netgear, if so HOW?
Can I setup some rules in RRAS to allow ONLY traffic from PH-01.

Please help the Grasshopper.