Yeah, PPTP isn't known for its strength, but it's better than nothing. And yes, it does use another protocol on top of IP. IPsec also does this with protocol 50.

The way that many consumer 'routers' deal with NAT and VPNs prevent more than one tunnel from being open at a time - since packets from the VPN server are encrypted it is not easily possible to determine which of the local hosts they are intended for. The easiest solution is for the router to allocate the entire VPN functionality to the first host that asks for it, typically by watching tcp/1723 (or tcp/500 for IPsec). Some newer routers can apparently allow multiple hosts to open tunnels - I'm not sure how they do this.

I'm a bit out of the loop on all this now.