NAT punching to ssh is an incredibly useful feature of this kind of setup. As long as the machine has an internet connection, and you know the onion URL, you ca

NAT punching to ssh is an incredibly useful feature of this kind of setup. As long as the machine has an internet connection, and you know the onion URL, you can tunnel into it and proceed from there. I usually do this to any machine I'm putting behind NAT. I don't know if onion links are discoverable/crawlable, so I can't claim if this is more secure than just listening on port 22 on the open internet. torsocks is a very useful tool for easily running programs like ssh through tor with no advance setup.