> I don't use FP, exchange, printing services etc. So either I get safety
> or convenience. At present the servers can't login to the domain and
> asides from the errors in the logs they appear to be working so I'll go
> with safety.

You could get the servers to do an IPsec tunnel to the LAN side.  A little 
complexity, but safety and convenience.