For Content Library, yes, the subscribing libraries would need to be able to contact the source library. For NFS, all ESXi hosts must be able to contact the same NFS mount. Otherwise, you'll have to use a replication technology to reach your DMZ environment.
