Thanks Jeff. In both cases the Gateway would be behind a firewall.

In the deployment examples I have seen the flow would be:

Client --> External Firewall --> Proxy --> Tableau Server

However, what I would like to see is:

Client --> External Firewall --> Proxy --> Tableau Gateway --> Internal Firewall --> Tableau Server (all the non-GW services)

With this method the termination and the authentication (I believe) would be in a separate secure network zone therefore if compromised limiting exposure to the DMZ services rather than the application network/services. Similar logic is often applied to splitting the application services and the data.

Thanks again Jeff. This is the confirmation I wanted to hear from the community. The 3-server deployment for HA did give me hope that this was achievable and as an added bonus this approach appears to map well into a HA/scaled out design if the requirements changed.

This transpired to be an unsatisfactory solution. Too many bi-directional ports needed to be open between the server running the gateway and the server running the other tableau services. Further, the use of high port ranges for the responses made a mockery of using a firewall.