First subnet: X.X.X.

0 /30
Second subnet: Y.Y.Y.0/30 or /29 (depends on what we require and will be specified)

Core network device

VPN device

Access device

X.X.X.1

X.X.X.2

WAN

Y.Y.Y.1

Y.Y.Y.2

LAN

Both the access device and the VPN device have to be at the site.
X.X.X.0/30 (WAN subnet) can be public or private.
Y.Y.Y.0/30-29 has to be public.
Y.Y.Y.1 must be pingable from the internet.
Y.Y.Y.2 must be pingable from the internet and we need the username and password for telnet access.
At least one of the interfaces of the access device has to be pingable from the internet.
Y subnet has to be routed via X subnet.
When tracing Y.Y.Y.1 from the internet, X.X.X.2 must be the first hop.