I use SSH to connect to my clients systems from my office. Because I know my static IP I use this in a rule in the clients router (infront of the SME in server/gateway mode) to lock SSH down to just my IP (and of course any other relevant IP I nominate).
I do the same for PPTP VPN access and to a more limted extent HTTPS.
Works great and means no messing about with the SME box.
HTH