You need to ensure that Server1 can read the dial-in properties of the user accounts in the eu.contoso.com domain
You need to ensure that users from both forests can establish VPN connections by using their own domain accounts