Just drop all inbound and access your home network behind a vpn remotely for the ultimate protection, not perfect, but far more secure. And monitor at the DNS level, or have a service running to monitor network activity on the terminals.