Why don’t you just plug the MCH into this ‘private firewall appliance’ and see what happens?
Yes, you can try port forward and you will see ‘Direct’ connection instead of ‘Relay’ or ‘Local’. The problem is that the stupid webapp may only accept ‘Local’ status and not ‘Direct’ when dealing with ‘settings’ and ‘enable local access’, at least that was what happened when I tried one time to do that. You should try it nevertheless.
