You bring up completely valid points about VPN access, and on the PC side of the world, I completely agree. I would never set up one of my clients to allow home PCs to connect into their company network via VPN without a huge number of resrictions placed on them, including but not limited to anti-virus and anti-spyware protection. The threat is just too great. And while it's not as great, there is still a risk with doing the same for the Mac.

The alternatives you present are also valid, but make a few assumptions:

1. Workstations have a fixed IP and not a dynamic IP.
2. The firewall/router connecting to the internet is capable of routing to a different port on the destination machine.
3. The SBS box is not being used as a gateway.

Where your solution breaks immediately is on a network where SBS Standard (no ISA) is configured with two NICs behnind a firewall/router. In this configuration, it's not possible to do what you suggest because the firewall/router does not speak directly to the internal network and the RRAS service on teh SBS server cannot do the type of port forwarding you recommend. This may not be the case with ISA 2004, but I haven't had a chance to really dig deep into that yet.

The reality is that the solution in this article is a compromise. The Connect to Remote Computer interface in RWW gets around all the connectivity issues you describe, but since MS opted to use an ActiveX component for the solution, it will never work on the Mac. So, we compromise. If all the workstations on the internal network have a static IP and connect directly to a hardware firewall/router that does port translation, great, use that solution. If the customer doesn't want to replace their existing firewall/route with one that supports port translation, we compromise. If the customer is routing all their internal traffic through their SBS box (which is a best practice configuration as far as I'm concerned) an is no running ISA and doesn't want to pay for ISA, we compromise. If the customer doesn't want to use static IPs for their internal PCs, we compromise.

In the ideal situation, which one of my consulting clients uses, port 3389 doesn't go to the SBS server, it goes to a Terminal Server on the internal network. No messy routing, no VPN, controlled environment on the TS, dynamic IPs on the workstations, it just works. Oh, there is the small matter of the additional cost of the TS and TS licenses, which many small shops won't want to incur unless they have a strong business reason to run a TS box, adn the convenience of connecting to their workstation from off-site isn't one of those, especially if they're running SBS and RWW.

Is the solution we've put forward in this article the best one? No. The absolute best solution would be for the Connect to Remote Computer process to use a technology other than ActiveX to work. This would open the door not only for the Mac but for other OSes out there that don't do ActiveX technology. Until that happens, this solution is one that works with just about every SBS installation out there. And as far as network security risk, opening up VPN access to Mac clients is far less of a risk than many other risks that SBS administrators implement every day - hosting FTP on SBS, opening up POP2 to the SBS server, running a web site on port 80 on the server, etc.

-Eriq

1. Fixed IPs are a simple to set up & a small price to pay for allowing Macs access to the company facilities. This is only for the systems that the Mac client needs to access - in my experience ususlly only a small number. Not all the workstations need to be set up as static IPs. Not much of a compromise here. 
2. Even the cheapest hardware firewalls allow port forwarding. If the customer has one that does not they should be encouraged to upgrade as I would not trust an Internet connection device so old it does not haev this capability. Prices start from $US40. If the business isn't prepared to pay this trfling amount then they certainly are not serious about their IT systems, let alone security. In reality any client I have dealt with would readily pay a small sum to increase security once it was explained properly.
3. It does not matter if the SBS box is being used as a gateway, and my solution does not break down at this point. Sheesh - basic networking!!  Here is how to do it:
   
   
   1. In SBS, open the Routing and Remote Access MMC from Administrative Tools.
   2. Expand your server, Ip Routing and select NAT/Basic Firewall.
   3. On the right panel select your external network connection and open the properties.
   4. Go to the Services and Ports tab, click Add, provide a name, select theprotocol, the incoming port (say 10001), the IP address of the workstation behind SBS and the outgoing port (3389).
   5. Ok the changes.
      
      This should allow the RDP on 10001 to come into the workstation through the SBS server.
      
      
4. I agree the "double NAT" approach using SBS as the gateway and a hardware firewall beyond is a best practice. I would not want to rely on just the basic firewall in Windows - the MS protocol stack is not hardened and traffic has to traverse this prior to getting to the firewall services. Similarly I would be reluctant to rely on just a low ent firewall/router as I have seen these fail while  leaving the network exposed.
5. Macs are just as vulnerable as other boxes - security by obscurity is no defense!
6. I empahtically dispute that a VPN on ANY uncontrolled box (Mac or otherwise) is "safer" than the other practices you mention. In fact the potential for damage is far higher (I have seen the results!) These other practices also need addressing, but I don't belive that adding another potrential security hole helps.

Please don't take this the wrong way - it's just that I would prefer to see best practice promoted and I don't belive that there are any real compromises to be made in what I propose. I also believe that there has been too much vendor hype pushing VPN solutions and not enough education on the risks of not doing it properly.

Cheers,
Ross