The VPN server is running on the Windows server that they need FTP access to. It's intended to be a direct link that they can use to bypass the firewall and get the same kind of access they have on their static IP block that we let through the firewall.

Hmm. Thought I'd answered this this morning, but I must have forgotten to take it out of preview.