If I'm not mistaken you can use DNAT, Remote Access VPN and VPN site to site for Access lan behind the Astaro but you have to see your network topology if you want access to the One SRV you can use the DNAT, or Remote Access that is very secure (create an user set the Remote Access for access to the Astaro then create a rule for this client), is trusted this client ?? but if you have 2 Astaro you can use the VPN site to site. for Ex. 1. set the Remote Access for one or more client/s 2.create a rule for this/these client/s --> ANY --> LAN or one Destination [;)]