If you have multiple systems anyway, then having a light-weight jump box (or 2 for redundancy) may be worth setting up. Then limit 'internal' hosts to only allo

If you have multiple systems anyway, then having a light-weight jump box (or 2 for redundancy) may be worth setting up. Then limit 'internal' hosts to only allow connections from the jump boxes / bastion hosts.