Glad to hear some people are at least trying to do things right!

There's a couple ways to do this...

First, you could run a node on the firewall itself to allow machines inside the firewall to connect to it's host cache... Second, allow all connections in/out of port 6346.

If you don't want to run a node on the firewall, you will need to map each machine to it's own port, and the one with 6346 will be the only happy one. Of course, if you have valid IP addresses for each system, you can give them all access of port 6346 on their own IP address.