Destination-NAT / port-forward entries that publish an internal service on a firewall-facing address.