I am going to make some assumptions here. You state "we have three separate servers that house IIS currently. Each of these three servers have the same public IP address" which I assume means they are only public facing for very specific services. They are probably allowing external on port 80, 433, and possibly a few others. If that is the case, I would not setup a method to connect remotely via that external address. Since the address is publicly available for web services, it can be scanned to find your "door for access" no mater what form that may take.
The simplest solution would be to setup 4 public addresses:
1 Public Address that is load balanced for providing web services.
3 Public Address that are redirected to the ports on each server to connect manage them.
Setting up the NAT redirection for the management addresses is a simple firewall configuration. It would look like this.
- Public Address 1 > Private Address of Server 1
- Public Address 2 > Private Address of Server 2
- Public Address 3 > Private Address of Server 3
Optionally you could have one public address to deliver services and one public address for management, but have a different inbound port for each server. Say you had ports 1000, 1001 and 1002. If you management service was SSH, port 22, then it would appear as follows.
- Public Address, Port 1000 > Private Address of Server 1, Port 22
- Public Address, Port 1001 > Private Address of Server 2, Port 22
- Public Address, Port 1002 > Private Address of Server 3, Port 22
Setup a Management Server or software that you then use to connect to each IIS server internally.
So you would have one public address for your web services and one public address for managing the servers. The First address is load balanced to your IIS servers, the second Address goes to your management server, possibly a Remote Desktop server, an SSH server or a server than provides VNC connectivity to the ISS Servers. Their are lots of third party options both free and paid that can accomplish this second option.
Setup VPN (Virtual Private Network)
If your firewall have the ability to act as a VPN concentrator, then you can setup VPN services. This would allow you to connect remotely using VPN. Once connected, you can then connect to each IIS Service using their internal IP Address.