owen1: a non-privileged port + iptables is often simplest to set up imo