In a typical slightly undocumented Microsoft move, you need to open up TCP port 4125 as well as port 3389 (which is the standard RDP port) to allow a remote user to log in through the SBS Remote Web Workplace. So why not just say so somewhere?