Cannot get reverse proxy for Lync 2013 to work.

In my experience, 90% of the time, this is a certificate issue (especially for OSX). The Lync client runs two authentication methods, one for the SIP registration, and a second for the Lync web services. This web service path uses an HTTPS-based auth via web ticketing services. Try navigating to the following via browser:

https://"lyncwebservice".domain.com/CertProv/CertProvisioningservice.svc

You should be prompted for user credentials. Enter your regular domain auth (whatever the client is using). You'll get a return via svcutil.exe with Front End Pool data and other neat stuff.

If that works, you know the web service URL is working. You should also be able to put https://meet.domain.com/CertProv/CertProvisioningservice.svc and get the same result. In my case, I just used CNAME's to redirect autodiscover and other webservices to the lyncsvc.domain.com external name published in Topology.

If you cannot get to that name, either the certificate does not have all of the names required for the web ticket service to create a token, OR the certificate cannot be properly validated. All of these things will break HTTP auth. The testconnectivity tool should allow you to expand the results and give you some more detail.