I normally put the MIPU on a DMZ or separate it from the firewall with a switch. The customer is using VPN tunnel to connect to this location.