But you have to specify not only the exposed port but also the destination address and port which is not easy to do accidentally.

edit: typo