You should only ever have hardware visible in the internal network, no need to put them on the Internet at all.