Due to certain limitations, a particular AD site cannot have local DCs, nor can site-to-site VPN tunnels be established to other sites. Instead, the domain members here use point-to-site/dial-in VPNs to connect to remote DCs.
The domain members can reach and access the DCs fine via the VPN, however, due to firewall and the nature of point-to-site VPN, the domain controllers won't be able to ever establish connections to these isolated domain members.
Is this permanent one-way design okay for these domain members? Or will there be any complications when it comes to certain features/scenarios?