So VPN in to a subnet where only a bastion host is exposed effectively?