How would I set up a VPN with access to a Samba share?

I've been searching for how to do this for hours, no avail.

I want to be able to access a shared folder on my Ubuntu server (hal) over a WAN, I want to be able to mount it as a drive in Windows. HOWEVER, I don't want to expose SMB to the Internet, because from what I've gathered that's a big security risk.

So, I need to set up a VPN on hal, which gives access to all shared samba folders on hal, but doesn't tunnel all traffic through it, just SMB.

Does this make sense? Is there a a guide for something like this? I am completely lost, I've never attempted something like this before.

Thanks.

EDIT: I decided to go for the easy option, I've installed hamachi, modified my firewall to use its interface, and now can access SMB over the hamachi VPN.