DATAFLOW and ON-PREM DB connectivity solution

motoray Yeah, sorry , that was poorly phrased and I edited my OP to make it more clear (hopefully ;-)).

But in a nutshell:

WAN (internet) Destination == all

Services (ie traffic restriction rules) going from the machine running the gateway out to the internet we do not specify any endpoint (ie wildcard FQDN) as in the MS documentation, rather only 0.0.0.0 for the endpoint over TCP on port 1433.

Which means, any local application generating TCP traffic over port 1433 will be allowed through the firewall and to its destination on the internet.  

As to the converse, ie any TCP traffic over 1433 in the direction of the server running the data gateway on the LAN will have to pass through the Microsoft data gateway first. My sysadmin explained that the gateway filters all traffic over 1433 and thus takes care of accepting only legitimate 1433 traffic from Microsoft before relaying it to the DB server.  This makes me wonder about the potential security implications, what about SQL injections and the like...?