In this simple case you should provide local.mydomain.com which would be already resolved in normal "white" IP address to allow connect to. What if you are behind NAT? Is there way to setup backward tunnel exactly to machine from what connect initiated?