If I NAT a public IP to a private address, does something using the
public address to reach the private machine have their traffic subject
to all the usual filters? My guess is yes, since the BM server is
what's passing the traffic through from the public to the private side.