https://www.carlstalhood.com/storefront-cr-configuration-for-citrix-gateway/

The Gateway URL usually does not need to be reachable from StoreFront unless you need the Callback for SmartAccess or non-password authentication (e.g. Smart Cards or Citrix Federated Authentication Service).