If I have a Linux firewall (iptables) doing NAT, does that mean I can't ssh directly to it from the outside? Do I have to port-forward ssh to another machine and then ssh into the firewall using the internal interface?