While that's true TA-t3, if you want access to only 1 or 2 machines or something behind the firewall thats what port forwarding is for. You port forward whatever port your SSH is one from the external IP to the internal IP of the machine and direct SSH then does become possible.

However, if you want access to more than one machine behind that firewall than forwarding a dozen different ports to a dozen different computers becomes nonsense. This is why I said VPN's are usually used to access multiple computers behind the remote machine (the internal network).

Really my confusion is though why techdork seems to be implying that using OpenVPN is not a secure method of creating a tunnel... but ssh is?