Separate Relay and "On-demand Support" server for on-premise

Hey folks!

So what I would like is to have one server to act solely as a relay server with no outer https access other than specific whitelisted ips which administration and technician will use.
That way the server will be protected from many outer attacks.

Then another server which will be used as a "slave" and forward the request to the relay/admin server that will be open for clients to establish a support session.

Can this already be done?