cacosapo: I dont think i fully understand you. Would the external address still be box1.domain.org:22 ??

The whole point is that anyone on the outside cant really even notice any difference, if they want to go to the ftp of box1 they just go to any ftp client and put box1.domain.org, and they can do the same for box 2 without the enduser having to change any ports.

I dont see that possible w. a NAT firewall, or maybe im just mistaken.

I dont even know if this is possible at all... a friend of mine a while back said it was but we never got into it.