you also can't forward ports which kind of makes sense from their security model, but is annoying when wanting to use one host as a bastion