As long as your servers have access to the Internet, even behind NAT — you will be able to use KernelCare patch server without any problems.
Generally, KernelCare requires connection to only two servers for a proper work:
Both IPs specified above might change in the future so additional check is required before adding firewall rules.
An additional IP is used for KernelCare agent installation/update:
If your servers don't have direct Internet access but can gain access to the Internet using proxy, the configuration is not that different. KernelCare can pick up standard environment variables for a proxy.
Make sure you have environment settings for proxy setup, and everything else will be the same as if servers were directly connected to the Internet: