Hey Mark,
Thanks for your suggestions and clear words. Unfortunately this will be a deal breaker then for our external access scenario. There is no chance to get port 4172 open by the external Firewall based on BSI restrictions ... 
However, thanks for now...
Greetz,
Matthias