We have a site-to-site VPN connection between our main office and our production web servers at our collocation using two SonicWall devices. By default, the VPN tunnel allows all traffic between the two sites. I want to restrict this so that we block all INCOMING traffic from the collocation to the office, that way our private network is more protected in the event that our production servers are compromised.
A problem that I'm seeing, though, is that our servers that we have joined to the domain still need to be able to contact the DC in our office for group policy, ldap information, etc.. After a bit of poking around for all the services and ports used by AD, I found that the RPC service uses random ports, which makes it difficult to punch a hole in the firewall to make it work. I found this kb article which describes how to change it to a specific port on all of your domain controllers, which would then allow me to open up a single port on the firewall. What this article doesn't go over is the downsides of doing so. I imagine they have the ports randomized for a reason .. and taking that away is removing whatever benefit that it provides.
What would I be losing by switching this to a specific port? The instructions have me edit the registry on all my DCs, which I would love to avoid. Also, would this be a good case in which we would benefit from having an RODC at our collo site?