Ideally the traffic would be siphoned thru a load balancer/reverse proxy of some kind rather than the dest service endpoint/port being directly exposed to the internet