Device Management from WAN with no VPN
Looking at the apple support page, I've discovered that 


Open Directory runs on port 625.
Password server runs on port 106.
Profile Manager runs on port 1640 &amp; 2195.
Remote Desktop runs on port 3283.
Push Notifications run on port 2196.
Simple Authentication runs on port 3659.
Bonjour runs on port 5353.
Software update service runs on port 8088.
Netboot runs on ports 67 &amp; 68.