There are services like BrowserStack or Sauce Labs that help with testing and test automation on different browsers and devices.
But, in order to solve the problem of an application under test being behind the VPN or firewall, they implement and offer this idea of "local testing":
Local Testing establishes a secure connection between your machine and BrowserStack servers. Once you set up Local Testing, all URLs work out of the box, including those with HTTPS, multiple domains, as well as those behind a proxy or firewall, and much more.
What risks are we taking allowing the remote selenium server on BrowserStack access to the internal resources? How secure is this setup and is there anything we can do to improve security?