通常這樣的架構可以採購支援VPN的IP分享器,他可以在開啟時直接建立VPN通道回AD所在地..
乖乖的用VPN吧,要讓防火牆外的主機加入網路要開的Port之多..
貼些讓你參考吧..

RPC endpoint mapper 135/tcp, 135/udp
Network basic input/output system (NetBIOS) name service 137/tcp, 137/udp
NetBIOS datagram service 138/udp
NetBIOS session service 139/tcp
RPC dynamic assignment 1024-65535/tcp
Server message block (SMB) over IP (Microsoft-DS) 445/tcp, 445/udp
Lightweight Directory Access Protocol (LDAP) 389/tcp
LDAP over SSL 636/tcp
Global catalog LDAP 3268/tcp
Global catalog LDAP over SSL 3269/tcp
Kerberos 88/tcp, 88/udp
Domain Name Service (DNS) 53/tcp1, 53/udp
Windows Internet Naming Service (WINS) resolution (if required) 1512/tcp,1512/udp
WINS replication (if required) 42/tcp, 42/udp
and ICMP protocol

尤其是這項 RPC dynamic assignment 1024-65535/tcp 就不太能..

請問這兩台一定要擺在firewall之外嘛(以安全性為考量) ? 如果可以建議移到firewall內, 要開服務的話再經由firewall開ports ....

Microsoft的一些通訊協定的TCP/IP port列表:

http://support.microsoft.com/kb/832017
http://geekswithblogs.net/TSCustomiser/archive/2007/05/09/112357.aspx
http://technet.microsoft.com/en-us/library/bb727063.aspx