Well, if you allow remote access, you conceptually allow some kind of logical inbound connection, no matter how it's technically realized.