Can traefik expose containers that do not run on the same server?

You can enter a service in the dynamic configuration and set the server url to the vpn tunneled service. Ofcourse Traefik needs access to that address.

See the following post for reference and code snippets