Just use a modern, secure variant of VNC or RDP. Most have reverse connect options. Assign (dynamic?) DNS entries to everything else that needs managed.

Don't make it unnecessarily hard.