Good day to you all.

We have two, firewall-isolated data centers, pretty simple:

DB1===FW1----Internet----FW2===DB2
      /
SS1=/

Now, we want to replicate from DB1 to DB2. We have a SSH tunnel from FW1 
to FW2, which is forwarding postgres port (ie. in Location 1 I can 
connect to service server 1 (SS1), which has opened tunnel to FW2, which 
in turn forwards it all to DB2).

The problem is, for replication to work, it seems to me, that DB2 needs 
to "see" DB1 also and therefore we'd need another tunnel going from 
location 2 to DB1 (which we obviously do not want). Am I right? And if 
so, is there a way to work around this?

Thanks in advance,
Michal