For a deployment server to push the files to its peers, the app containing those files must lie under $SPLUNK_HOME/etc/deployment-apps. When you deploy an app, it gets installed under $SPLUNK_HONE/etc/apps. Since there's no direct way, you can try the following:
1. Have main DS push the config to the server behind firewall.
2. Write a simple bash script to to copy the app to the $SPLUNK_HOME/etc/deployment -apps directory in the secondary server. That script can be designed to check for the changes in the file and copy again to the deployment -apps, should you push an update from the main DS. You can do this by calculating hash of the app and keep checking it for changes (This is how Splunk does it too, they call it checksum to check for updates on DS for peers)
3. Have your secondary server push the changes to its peers for the first time/everytime there's a change in the app. You can configure this in the script itself to traverse to the /bin directory and run the command splunk reloaddeploy-server -class <<yourclassname>
Hope this helps,
**Kindly consider accepting as answer/upvoting if it helped you**
Thank you,
Shiv
###If you found the answer helpful, kindly consider upvoting/accepting it as the answer as it helps other Splunkers find the solutions to similar issues###
