Brilliant! When I googled for Apple Remote Desktop, I found this, and assumed it required an additional purchase.
http://www.apple.com/remotedesktop/
I still need to research how to use VNC to get throught the firewall. eg on my mac the IP for VNC is the local IP 10.0.0.2
UltraVNC specs mention NAT-to-NAT capability.