...
This allows the Content Manager Server to remain protected within your LAN, and the T4S Server to be configured only to only allow authenticated requests from the customer's Salesforce Orgs and Sandbox through the firewall.
The T4S Server Requirments
...
Within Salesforce only CA-certified domains will can be able to be call-out to and connect connected back.