I've been using a paid Teamviewer license to manage a fleet of Raspberry Pi 3b+ (50+ devices installed, 50+ incoming), doing some monitoring behind either a 3G/

I've been using a paid Teamviewer license to manage a fleet of Raspberry Pi 3b+ (50+ devices installed, 50+ incoming), doing some monitoring behind either a 3G/4G router or behind a firewalled enterprise NAT. So far, it has been the most reliable way to connect. I've tried multiple VNC and RDP clients, and when dealing with "hidden behind a network" systems, Teamviewer works very well, with little to no overhead. Specially since they have an special client for RPi monitoring, which works fantastic in my opinion. If you don't have the option to pay for those licenses (which I did for several months), and no direct SSH access is possible to the machines, you can setup a cloud gateway SSH server or a VPN network.