Does this only work if LE can reach port 443 on one of your servers/proxies?

Yes. If you want to create certificates for a private server you have to use a different mechanism, such as dns-01.