puppet and external hosts

Right now I'm setting up the torrent box to use puppet. In order to do this puppet needs access to lockbox. In order to do this I've decided it best to use ssh forwarding. We've talked about VPNs in the past, and we can discuss it again in the future. For the time being, however, I think I'd prefer to be more surgical. Can anyone think of any issues with doing this? We've never actually made this link before with external hosts, even the fas integration uses a public facing website to wget the info we need. -Mike