SCAN LISTENER with Microsoft Direct Access

So I implemented an ODA v1 upgraded to 11.2.0.4.  The scan listener works when I am in my local facility LAN connection, but outside the LAN when I try to connect using Microsoft Direct Access I get an ORA-12170 time out error.  I can change to a direct connection and use the physical hostname and it will connect, but I would like to use the SCAN LISTENER.  I am not sure why it is timing out with SCAN LISTENER through Direct Access.  Any ideas?

A firewall somewhere blocking TCP port 1521 to the SCAN addresses would be my first guess...

Other reason, I think the client can not resolve hostname.