The diagram reads bottom to top. Connections can be initiated from - a managed virtual desktop (on a trusted network) - a managed physical laptop (on a trusted network) - an internal application (on a trusted network) - a managed physical laptop (on an untrusted network) All connections always pass via an outbound zone where controls are enforced, and are only allowed to the remote location via HTTPS, which in turn is tunneled through a leased line, a VPN, or the public Internet.