You don't need to purchase VPN endpoint routers to accomplish this task, although it makes the job much simpler.
If both of you have Win2k Advanced Server on your internal LAN then just install Routing and remote access services on the domain controllers and configuring VPN Remote Access will accomplish this task. You can link both the domains using trusts so that you can see the other domain in your network places.
Use the custom configuration option when configuring Routing and Remote Access services and select VPN access. Complete the wizard and then you'll be able to configure VPN access to your server more thoroughly by using the Routing and Remote Access MMC snap-in.
Create a static route between your Win2k AS and your friend's network - instruct him to do the same. If you have a linksys or comparable internet gateway you are going to need to enable IPSec passthru on the device for the communication to work properly. My recommendation would be to buy a book on Windows 2000 Advanced Server - one that explains VPN thoroughly.
This will take some time to set up and a lot of trial and error, but it's a cost-effective way to connect two remote domains.
As far as which ports need to be opened for VPN - you should just need the IPSec passthru as well as an open port to communicate to the VPN server with forwarding enabled on your firewall/router. I don't know them off the top of my head, but a quick search on google with the text "Windows 2000 Advanced Server VPN ports" should turn up some results.
HTH!
--James