Do not forward port, just use a private network and static IPs.
Setup a common utilities machine.