Sounds like you might have a pretty good backbone in place already. If you have remote connectivity already (IPSec tunnel to the 4430 or another WAN path), then phones ought to be able to reach your 7100, generally speaking. SIP endpoints generally don't work over NAT, with some exceptions. But if your remote phone(s) can reach the SIP server over VPN and other routed WAN segments (non-NAT), then I think you have the basic path ready.
Are you wondering about an optimal topology, or are you looking for specific config examples?
Got sets working through VPN to 4430. Progammed as remote set in 7100 phone config file and programmed settings for SIP server and SIP line identification in pohne at far end.