(not the GP poster) By my reading the rate-limiting case was covered as the exception in a latter part of the comment ("This could be useful in rare case when

(not the GP poster) By my reading the rate-limiting case was covered as the exception in a latter part of the comment ("This could be useful in rare case when you have a very big firewall able to limit the number of sessions toward your small inside-server.") But in the usual case you'll block connection attempts to the wrong port statelessly, and there's no benefit in tracking the served sessions in an external firewall.