It is recommended to keep the server inside the firewall. Your design looks perfect since relay server is not supported by syclo apps and you are going with reverse. Also not that in SMP3.0 agentry apps will not supports reverse proxy. In future it may be supported.
Midhun VP