You may have to install your Management Gateway with only an internal IP address (say 192.168.30.30) behind a Network Address Translation device (say a.b.c.d). This seems like it should work, and you can use the web interface fine, but clients don't connect.

The error message when running Brokerconfig.exe and clicking Test on the client goes like this:
27:35.312   Certificate name mismatch.  Expected name a.b.c.d.  Common name gateway.customer.com.  Alternate names ldmg.customer.com broker 192.168.30.30
27:35.328   Connection through management gateway failed 14 SSL name mismatch

Solution: go to https://brokername/gsb, click Gateway Service, click Additional Host Names and add the Expected Name a.b.c.d to the list.