I have mine in a DMZ, so it can be fully exposed with software firewall. I thought it’ll be less work to setup and maintain. Wich it is, when I have a small project I can just plug my pi into the DMZ and it’s good to go.