what if the endpoint is behind a VPN and a client is not on the VPN? or the client is offline?