Can't Administer Remote ARD Clients Over Internet

Question

I am attempting to use Apple Remote Desktop to administer a computer in my office remotely from my home. So far, I have been unable to access it remotely (everything works fine if I am within the same LAN as the target computer). As far as I can tell (from reviewing other posts in this forum), I have configured everything correctly to make this work, but still no luck. Here are some details about my setup...
The target network router has a dynamic public IP address assigned by my ISP, so I have set up a dynamic DNS host for it at DynDNS.com and installed their DNS updater software on the client computer to properly resolve the hostname to the current IP address of the router. I set up port forwarding on the target network router for ports 5900 and 3283 (both TCP and UDP) and directed those ports to the internal static IP address of the computer I am trying to administer. I have tested the ports using the DynDNS Open Port Tool and both ports return a result indicating they are open and accepting connections.
When I attempt to access the target computer through ARD from outside the LAN, I am entering the dynamic DNS hostname in the "Network Address" section of the Scanner and it will show up immediately in the computer list below with the correct public IP address listed for the network router. However, when I attempt to add the computer to a list so that I can begin administering it, I am unable to verify my username and password for that target computer and it results in the entry showing up in the list as "offline." As I mentioned before, I can access this computer without difficulty using the same username and password when I am located within the LAN, so it does not seem to be a problem with those.
It would appear that my queries to this target computer are not getting through even though I have forwarded the necessary ports in the router. Any thoughts?

Answer 1

You want to be careful about opening ports that don't need to be opened, I'm not any kind of expert, but if you only need tcp, don't open udp just incase. Close the udp.
I know, I just opened it up to test things out. I closed it again as soon as I determined that was not the solution.
What kind of firewall is on your router? Is it something that you edit like a text document or do you click an add button and type a port number... specify an ip for the port to be forwarded to or just  a list of check boxes to open a port? Does it have or need you to tell it ip destinations for both directions? My firewall you have to tell it incoming traffic from external network on port x goes to ip xxx.xxx.xxx.xxx and outgoing traffic on port x from ip xxx.xxx.xxx.xxx goes to external network. I would guess you don't need to specify both directions on yours, but you might want to check.
The router is a Actiontec PK5000 DSL modem. It has a GUI for editing the firewall settings (not a text file). As far as I can tell, you only need to specify port forwarding exceptions for incoming traffic, not outgoing. There are some fields within the port forwarding section of the GUI which are identified as "optional" entries that I don't quite understand, but I don't think they deal with outgoing traffic. They are identified as "remote ports" and "remote IP". I have been asuming that you would enter something into these fields only if you wanted to allow the specified port forwarding exception if the incoming traffic was from a specific external IP address and/or port(s). There is a notation next to these fields that says if you leave the fields blank, it will apply to all IP addresses and ports.
Now that I think about it, I'm not sure that I have ever tried entering anything into the remote port fields to see if that makes a difference. Perhaps I should try that. For example, if I am specifying that I want to forward port 5900, maybe I should try entering port 5900 in this optional "remote port" section as well. It seems like I should probably still leave he remote IP field blank. I won't be able to give this a try until I get back to the office on Monday.
One other thing... the router interface has the section I have described above called "Advanced Port Forwarding" but it also has another section called "Applications" where it seems that they have identified a number of pre-defined port forwarding rules that apply to specific applications/games. I have looked in there and there doesn't seem to be a pre-defined entry for ARD (there is one for VNC that opens up port 5900 only). Each entry specifies the ports to be opened up and then there is a blank field where you can enter the target IP address to be forwarded to. It is also possible to create new user-defined application entries in this section, so I have previously created a new entry for ARD to see if I might get a different result, but the end-result was the same.
I have considered buying a new dedicated router like the Apple Airport Extreme instead of using the router functionality of the DSL modem, to see if it's a problem specific to the router. Do you think this might get me anywhere?