You should definitely block the VNC ports (580x & 590x) from the Internet with your router. Otherwise, it is nice to be able to use VNC without SSH within your home LAN. If you haven't restricted access from other local computers, you can even use a Java capable browser and just point your browser at http://server.ip.address:5800 and log in from the browser. At least this works with RealVNC.