Yes, absolutely know how to do this.

It's actually all documented (with examples)in my BMgr 3.x book and my
filtering book. The filtering book shows how to do this with static
NAT. The BMgr 3.x book shows how to do this with generic proxy.

For outbound port 22, you just have to set up a single stateful filter
exception for tcp dest. Port 22, from private to public interface.

Inbound 5900 is a bit harder. You cannot static NAT the primary public
address, which means you will have to use generic tcp proxy. You will
need to set up 3 things - the generic tcp proxy entry for port 5900, an
access rule to allow generic tcp proxy port 5900, and at least one
filter exception allowing port 5900 to the public IP address (source &
dest. Interface=public). If you don't make it a stateful exception,
you'll need another filter exception to allow the outbound source port
5900 from the public Ip address for the proxy responses.

Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com ***