Manichean's valid point:
You are leaving the Kitchen cat door unlocked when you port forward.
It is best to to put the jewels in another room . (You have seen 'Klepto' on you-tube?)
The point being: give stuff you expose to outside
access their own computer
for the safety of the rest of your data
.
Do not allow easy 2-way access from that computer to the rest of your computers (no permanent shares
used).