There are three ways to configure the K1000 appliance for remote access.
Please review the link below for a general diagram, in PDF format, which details the three different ways that the K1000 can be configured for remote access.
Reference:
http://downloads.kace.com/support/downloads/faq/PublicInternetKBOXSSLSetup.pdf
1. The first way, Site X, is a private-network to private-network over VPN. It's assumed that the K1000's private IP needs to be hidden because of possible network conflicts at the site.
2. The second way, Site Y, is private-network to private-network using contiguous address spacing and no port-forwarding.
3. The third way, Site Z, is for a K1000 on the public Internet. It's configured with a private IP address and uses port-forwarding from a public IP address with a split DNS configuration.
This list doesn't examine all of the ways that a K1000 can be configured for remote-access. The simplest case; a K1000 with a public IP-address, is left out, for example.