Below the networking diagram, which assumes that the VPN-Box has an official IP-Address and the firewall routes this traffic to the VPN-Box.