Lync 2010 Fail

There are a couple spots to look at here depending on your lync configuration. If Lync was signed in previous to network access (assuming full VPN), fist determine what FQDN the client is trying to get to. If you used group policies or manually assigned internal and external names, it should be trying to connect to the internal lync pool on 5061 or 443 (2010 allows both). If it's setup to autodiscover, it may still be trying to attach to the previously used external name and then network config is preventing the client from resolving proper external address spaces and ports.

I would grab client logs and tcp dumps (from the client) to see what the error conditions are (be prepared to SSL dump or deencrypt the traffic on your test client with the key of the SIP cert), I suspect it cannot resolve the name it was previously using OR the name's available but the port isn't. One other thing to check is turn on the client ONLY after you've established a full tunnel. Just for testing.