I wonder if it makes sense from the security perspective to access applications using ssh port forwarding, rather than opening ports for the applications?