What about a VPN router that you access remotely and turn on/off firewall rules as needed?

I have a client where we setup forwards so the lighting programmer could get to the system. I wanted them to use the VPN tunnel but they claim they have had trouble with this in the past. So I setup forwards and they used them weekly at client move-in to tweak the programming. Forgot to turn them off.

Fast forward a year or so and client complains Savant won't talk to Lutron (which is setup via ethernet). After several restarts over a couple of days I determined something from outside was hammering the Lutron on the open port causing it to lock up. Removed the forward and it's been working fine ever since.