Device Management from WAN with no VPN We're setting up about a dozen mac mini's across the city that need to be managed from a central lion-server.

Our IT department is willing to open up some ports and forward them to our lion server but they are not willing to give us VPN access.

What ports do I need to forward to the mini server in order to manage the devices?


I'm thinking mostly of when I update a profile and need it to be pushed out to the other devices.  
I also need each device to be able to authenticate via Open Directory when the machine is remote. Of course I'll setup "mobility" but I still need the machines to sync changes like new passwords when they "can" connect.  
Lastly, I'd like to be able to connect FROM the server TO each Mac mini via Apple remote-desktop. (The machines will not have static IP addresses on their side.)
Looking at the apple support page, I've discovered that 


Open Directory runs on port 625.
Password server runs on port 106.
Profile Manager runs on port 1640 &amp; 2195.
Remote Desktop runs on port 3283.
Push Notifications run on port 2196.
Simple Authentication runs on port 3659.
Bonjour runs on port 5353.
Software update service runs on port 8088.
Netboot runs on ports 67 &amp; 68.