Set up team city 7.1.5 agent checkout and vpn

I am trying to set up team city with git. I have team city server on 1 machine a and team city agent on 2. Also we have vpn enabled on the agent machine, that allows get access to stash server. I am using default private key method for authorization. And I get error like this:

Test connection failed in ---. List remote refs failed: com.jcraft.jsch.JSchException: java.net.UnknownHostException:---.

Question: Do I need to set up vpn on the teamcity server or it is needed only on teamcity agent.

The documentation for TC 7.x says the following:

Please note that this mode affects only sources checkout. Current revision and changes data retrieving logic is executed by the TeamCity server and thus TeamCity server should have access to VCS server in any mode.

http://confluence.jetbrains.com/display/TCD7/VCS+Checkout+Mode

If the only way to access you source code repositories in stash are via the VPN you'll need to set up the VPN on the TeamCity server as well - even if the checkout mode is set to "Automatically on agent".