I'm adverse to opening up a lot of ports. VPN never caused any problems (other than the nuisance factor) since the problems I had still occurred when local.I use VPNs for other reasons but my syncing is direct to my server's SSL ports without the VPN. Maybe that was the cause of most of your problems?
And, in recent iOS/OSX versions, I've noticed setting up accounts on an OSX server is much improved, more reliable and easier... it "recognizes" it.
While they did add an option for OS X Server in setting up Internet accounts on a Mac (but never for an iOS device) it never worked for me -- I always had to have two entries, one for contacts and the other for calendars (and todos).
The servers are also opaque. No published backup/restore process -- just try to move the databases to a new server. If something gets corrupted you basically have to start over with a fresh Server.app install. That's what happened to me and caused me to drop it after nearly 5 years for iCloud, which has been working flawlessly.