Why not benefits of local and cloud, using only local?

Just put your controls in a DMZ and allow SSH. I know, sounds too hard, but you could give people a simple config file and/or script that could be called by a desktop icon to bring up the tunnel with one or two clicks.