Before that wouldn’t hurt to simulate situation when the accountance program client loses connection with server. Expected error - database on server needs to be reindexed each time client loses connection while doing some entries. In some situations the only solution is remote desktop connection to the server and running client there.
In that case, just dst-nat 3389 TCP port (with IP restrictions, just in case) and jobs done.
I myself use PPTP for connecting from unsecured places (hotspots etc.) and IPIP tunnel to connect internal networks of company branches. No need to crypt all the traffic, because I have no paranoya that my ISP would sniff traffic