Yup, Google takes this level of control out of your hands. At least there was an "advanced" setting in there so I could direct port 22 to my desktop, allowing me to ssh in from the outside. Nothing else I do requires anything beyond the standard NAT functionality.

An amusing related thought: my Nexus 5X bit the dust yesterday. Some sort of common "bootloop" error that results from a hardware failure. Anyway, I originally paid for the extended warranty, so I ponied up $70 and a new phone should be arriving today (although it's nearly 10pm and no delivery truck yet). Well, without my phone, I cannot administrate my network. Everything is built around the phone app. I've got so damn many apps for all the things that reinstalling everything on a new phone seems to be about as much fun as changing your credit number when it's being used for auto-pay on a zillion web sites.