RAC SCAN and NAT

Hello,

We're running a RAC OneNode and have an outside vendor who connects to our cluster through a NAT address.  When attempting to use the SCAN IP the redirect to the active node VIP does not work due to the NAT (the vendor's application cannot connect using our internal IP).  So as of now we have them connecting directly to the VIP of the active node, which is fine unless we fail over.  Is there a workaround for this?  I had heard of a TCP proxy but am not sure if that's the best solution.  We'd like to have multiple IP