in the following case you should be warn that if only one of a client connects outside, all your clients will be available from outside. For this reason you must find an client that can accept or refuse connections depending of ip address. I think there's a Gnucleus client that is able to do this