Windows 2003 – 2 DC behind NAT but members of the same domain

I have two domain controllers at 23 different locations. Both behind firewalls using NAT.

I have users that go back and forth between both domainds.

I need both DCs to be able to authenticate the same list of users and process Group Policy.

I thought have the 2 servers connected via a VPN would solve the problem but no.

Can anyone provide me with tips or a walkthrough on how to do this?