Remote desktop OUTSIDE network

Question

Hi all,
I'm a general user, not a server user, so I apologize in advance for my ignorance. Here are the specs:
Me: Mac Pro, 8 core, 10.6.8, wireless hookup via Comcast
Controlled computer: iMac, 10.7.1, no firewall, ethernet hookup via Comcast
Situation:
My grandparents are 92 and 95 and they've been Mac users for a decade and a half -- that said, they're in their 90s so if an icon gets moved or something is downloaded to a different location, the wheels fall off the truck. For the past several months they've been out of communication because they can't remember their email password (it's more likely that they aren't noting that the password is Case Sensitive). Their old iMac was the orange bubble iMac, so it was time for a replacement. I bought a new basic iMac and am going to ship it to them (they live in another state), but first I wanted to set it up exactly as they'd need it. While I have it, I figure now would be the best to set up VPN where any time they have trouble I can tunnel in via VPN and take over their computer as an admin.
I can't figure it out, sadly.
I am fairly sure Apple Remote Desktop only works for people in the same network and that's all I can find while researching on the 'net. Would that work once I use VPN for someone 1,000 miles away? How do I set it up? What software would you recommend (it doesn't have to be free)?
Am I right to think the following?:
I download a VPN client to my computer.
I download a VPN server to their computer.
I turn all sharing on via System Preferences on theirs.
How do I actually see and control their computer? How do I set up a user/pass to get in?
Note: Security is not an issue -- nothing they will do on this computer needs to be secure. It's web browsing, emailing, and Skype -- they don't have control of their own finances.
In a perfect world I can reset their passwords if they forget them, turn on some classical music while they're having dinner, change their background to pictures of their grandkids, do all of the system updates for them, and install new software that may help them.
MANY thanks to anyone who can help me figure this out!
Matt

Answer 1

Sorry for the length...
You actually can use ARD (Apple Remote Desktop) to Admin a computer from afar not connected to your network.  It does not require VPN or VNC access.  I do it all the time with a computer, also for my grandparents who are 81 & 83 years of age located in the Midwest...I live in California and access it about once a week when as you put it perfectly "the wheels fall off".
The key issues that I ran into when setting up the connection that I use are the NAT tunneling that is needed due to the Router that my grandparents use to connect to the Internet and the DHCP which I had to modify in their router for the assignment of private IP addresses in their home.  Since the router is set up for DHCP (needed) I had to specifically set up and assign a specific internal IP address as a static address to their single computer while maintaining the rest of the assignments as dynamic DHCP for the reasons that follow.  My sister goes to visit them frequently with her laptop (WIFI connection) and I take my laptop (WIFI Connection) and other devices (also WIFI) with me and access the net when I visit (about once a year) with their network.
The DHCP that the router uses to normally assigns internal IP's, does so on a first come first serve basis and creates issues where the IP address that ARD uses to access the client computer could potentially be assigned to another device if it connects to the network first before the client computer, or the client computer is assigned another IP address by the DHCP due to the routing table.  This causes some issues as in order to use ARD through a router to a client computer on another network you have to know the IP address for the connection (ISP assigned IP address) you are trying to enter through (often dynamic IP) and then you have to know the specific internal IP address for the computer on the network for NAT tunneling.
In my case my grandparents luckily are on a static IP address assigned to them by their ISP so I only had to overcome the Router configuration issues.  There are however reporting services that are paid (usually inexpensive) which use a small program on the client computer to broadcast the IP address to the secure service which then keeps record of the current dynamic IP that the computer is on so that if it changes with the ISP, one only needs to log into the service to retrieve this current IP and then they can access the client computer with it after reconfiguration of ARD. (This is the first mountain to climb)
The issue that often times these days is the second mountain that you have to climb is the DHCP and NAT tunneling.  This is in the client computers router configuration and is individual to each router manufacturer and model so I recommend consulting the manufacturers router manual on how to configure the router for NAT tunneling.  Not all routers can be set up for this, for instance my time capsule I have as a router behind a router configuration at my home to get full use of my 802.11N speeds for multiple devices that are capable of the N protocol will allow for this and the "Back to my Mac" service; which essentially does near to the same thing as ARD does, however my AT&T Uverse Gateway which is an 802.11G router...though quite sophisticated is actually not capable of the services needed to remote control the computer behind it as a client computer for “Back to my Mac” which is another reason I use the Time Capsule as a router behind the gateway.  It also gives me two separate private networks and a bit more security though can cause issues if not properly configured.
These are the issues that I ran into when setting up the remote administration of my Grandparents computer and I have successfully maintained this remote access for over a year now with few issues.  (It still blows my grandparents mind that I can do this from California).  I do have to say that the router configuration was done with another party (my mother) being my eyes and ears in the Midwest while she was visiting them, though it was my configuration instructions that allowed her to set up the router configuration for NAT tunneling and single internal static IP configuration while maintaining DHCP for other devices (she's wouldn't know where to begin when it comes to router configurations and I have CCNA training).
I hope this helps at least with the hurdles that need to be jumped in most remote network accesses using ARD and to assure people in need of this information or with questions regarding it that it can be done with the correct configuration and a router with the capabilities on the client side.
Also in case anyone is wondering my grandparents have a Netgear router though I don’t endorse any one router or manufacturer.  The important thing here is the routers capabilities not the brand or model.
Message was edited by: Dark_Angel