If this is a classic DMZ then you must also have a firewall between the UAG and a connection server, and you do not mention that. It may be that the problem is the configuration between the UAG and connection server. If you are sure the traffic is going through the UAG then examine the connection server logs. Also port 4172 is only PCoIP, which is probably the default for the thin client, but if it is configured for Blast you need port 8443 as well, unless you specifically configure Blast for 443.