Nothing is supposed to ingress, that's the point. You'd do a TLS exchange with the proxy on the outside of the protected network. Then proceed as normal.