Reaching SQL Server AlwaysOn HA listener from the Internet I've successfully created a SQL Server AlwaysOn High Availability Group between two servers and everything seems to be working great internally. Each replica is on a separate physical location, behind different firewalls and public IPs, as well as private IPs/subnets. Right now they are able to communicate directly with each other through a site-to-site VPN. 

The application that I use to access the database is able to connect to the listener's DNS. Both Failover Cluster nodes and SQL replicas have private IPs so as long as I run the application within my network, I'm OK.

The issue that I have now is that I need the application to be able from anywhere in the world. Basically, I need to be able to connect to the listener from the Internet without having to VPN in and still be able to take advantage of the HA//Failover capabilities.

How can this be accomplished? The only documentation that seems to be posted online relates to Azure which doesn't apply to my setup.

Thank you!
It's generally considered a really bad idea to make your database accessible from the internet. 

Making the database accessible from the public internet is a HUGE security risk. It's easy to port-scan and find publicly accessible databases. Even if you run on a non-standard port, it's relatively trivial to discover the SQL Server instance that is internet-facing. Your database would be available to anyone to exploit. It's likely that you'd be victim of every zero-day exploit, in addition to brute force attacks. Eventually, your data will be stolen or destroyed. 

Take a look at shodan.io to see how easy it is to discover databases on the public internet. You will essentially have a big sign saying "HACK ME" hanging on your IP address. 

Ideally, you would have a web service that the application would interact with. That public web service would be the only thing that connects to the (non-public, firewalled) database. Doing this would require re-architecting your application to use the web service, rather than a direct client-server database connection. If you can't re-architect the application, then VPN is the only secure solution.