VPN "Destination Unreachable"

Question

Trying to use VPN in Lion (to connect to a Lion Server I configured in another building), when I try to connect, it fails. Viewing console messages on the server shows my requests never arrived. So I used Wireshark to do a packet capture of en0 (my wifi is off). I think I have discovered the problem, but I don't know the solution. The packet capture shows the following error about 30 times in a row each time i try to enable VPN:
Source: 10.0.1.4
Destination: 10.0.1.1
Protocol: ICMP
Info: Destination unreachable (port unreachable)
10.0.1.4 is my Mac and 10.0.1.1 is my AEBS. Why would attempting to initiate VPN cause this error?

Answer 1

Ok, so your "in another building" reference was intended to indicate this is a remote connection, across the internet, and definitely across an insecure connection, and not (as I'd erroneously interpreted it) in a campus network at a somewhat larger school or business site.  The "in another building" can be a reference to a different IP subnet within a larger organization's internal network.
All of which means you're not going to be using an IP router to bridge to an outer and trusted network; you'll want a gateway device, and you're probably also stuck with the morass that is NAT.  And parts of what I've referenced earlier will be wrong for your requirements.
I'd guess that there's an IP routing configuration issue here.  A bad subnet, or a bad gateway address, would be my initial suspicion.
As a first test, switch your iMac to the wireless connection, and see if that works.  Get it using the same path as your iPad.
Unless you have a public static IP address, you'll (unfortunately) need NAT here (somewhere).  But the question is whether your "modem" is actually a gateway device. Iis your Airport getting a private-block address from that modem device?
If you're getting a private-block address from the modem, then the modem has implemented NAT, or your ISP has implemented NAT gateway somewhere outside of your modem.  For instance, AT&T Uverse implements a private NAT address on the "outside" of your local modem configuration, and this then leads to very specific (and somewhat weird) private network set-up requirements for that ISP.
What features does the modem have, and what access into its configuration are you permitted by your ISP?
If your modem is providing gateway features (some do), and particularly if it is providing DHCP and NAT services, then I'd switch the Airport to bridged mode (AP mode), and let the modem deal with NAT and DHCP for your network.
If your modem is providing DHCP and NAT, then switch your iMac to use what the modem is providing, and not what the Airport Express is providing.
Above all, you do NOT want double NAT here.
Though it probably won't help you for this specific modem (unless you can gain control of it directly or via the ISP), I prefer the following general configuration for connecting a small business network to the Internet, when the ISP requires a modem:
The wild and wooly of the Internet,
and which conects to modem (and the "dumber" the better; preferably a modem implemented as a "bridge" and not as a "router", and with as few features and capabilities as I can acquire from the ISP),
and the modem then connects to a gateway device I manage  (and which is inherently also a router, and provides the NAT),
the gateway then connects to network switches if and as needed,
and the switch (or the gateway, if that has an embedded switch) connects to WiFi.
And I prefer the gateway implement the NAT and VPN here, and not the WiFi device nor the modem.