We are developing a product that runs on Windows Server 2008. This product gets installed into a customers environment running on dedicated hardware (that we own or at least service) using Server 2008. We consider this an 'appliance', though it is basically a set of X high-end machines running Server 2008. Anyway, we need to remotely manage these servers in the customers environment and are looking of the easiest secure way of managing them.
A VPN is the obvious solution but because each customer implements their own choice of VPN it makes it very hard for us to support that (we'd need many different VPN software setups here to remote in). Another choice is having the customer open a port for RDP traffic so we can just remote in to our servers. But that of course is risky (even if we choose a non-standard port) and customer IT guys really don't like that.
So recently I was reading about TS Gateway (now RD Gateway in R2). I am wondering if it might be the perfect solution for us. If we set this up on one of our servers in the customer site and then had them open up port 443 directly to that server, would this be a secure mechanism for us to RDP into all of our servers at the customer site? It seems like their IT guys might be more receptive to this.
Note that our 2008 servers in the customer environment are not domain joined, they are a simple workgroup.
Thoughts? Am I missing something? Are there better solutions out there?