Accessing multiple macs with ARD from remote location with Airport Extreme

Question

We have an office with a newer Airport Extreme and three macs on the network. We have turned on the Apple Remote Desktop in the port forwarding, but we can only access one computer at a time, and only if we port map it to the local IP of that computer (Ex 10.0.1.2).
We would like to be able to access all three computers from a remote location. My question is this -
Can I have a wildcard IP, or is there an IP I should use for ARD?
Do I set up multiple port mapping with different ports and IPs?
All computers are running 10.6.1 with the latest ARD updates.
Any assistance would be appreciated.

Answer 1

Great answer by Dave Sawyer:
"To be able to connect to a workstation from outside it's network, the ports that ARD uses must be open on both ends of the connection. ARD uses ports 3283 and 5900 so those must be open.
If your workstations get their addresses from an NAT device rather than being "real", the ports also need to be forwarded in the router to the workstation's internal IP address. ARD uses port 3283 for the reporting and updating function, so if your Macs are getting their IP addresses through NAT, since you can only forward a port to a single workstation, you can only get reports, push package/files to etc. for a single workstation.
ARD uses the VNC protocol for observation and control, though, and there are a range of IP addresses for that protocol, starting with 5900. ARD uses 5900 by default, so that port would be forwarded to the first workstation. To be able to control more than one system, though, you would need to install VNC servers on the systems (since the ARD client cannot listen on any port other than 5900 while VNC servers can be set for other ports such as 5901, 5902, etc. You would then forward 5901 to the second workstation (and on to 5902, 5903, etc.). You can then use the following information:
Remote Desktop 2: How to specify a port number for a VNC client to connect. -http://support.apple.com/kb/TA22880
The only other options are: 1) to run the ARD administrator on a workstation on the network, and then take control of that system from outside, either via VNC or another copy of ARD, or 2) set up a virtual private network (VPN) so that when you connect from outside, your admin system is officially part of the local network.
Hope this helps."