Hello @sakuraime and welcome back.
If your source is on-prem and in a network behind a firewall, you should put your self-hosted IR on prem in the same network. The closer your IR is to your source, the better the performance.
IR separated from on-prem source by firewall, cannot talk to your source.
Only exception might be when you join/peer your on-prem network and virtual network. Still, closer to the source, the better.