So I nuked the server, used the wizard to build it again- now both the win laptop and android phone can use the VPN, plus I have access to all of my machines on my LAN. What I find odd is I used the wizard last time around (proof is now the copied/redundant firewall rules the wizard generated)... huh...