Azurefirewall sandbox template: add DNAT rule for SSH/RDP?

We are looking into Azure FW and found the Jumphost sample:
https://github.com/Azure/azure-quickstart-templates/tree/master/101-azurefirewall-sandbox

I was wondering why that sample does not just use a DNAT rule for Jumphost RDP/SSH access, instead of a public IP on the VM?

Suggested updates:
- Update W2k12 -> W2K16
- Add option for Linux VMs
- Add DNAT rule for SSH/RDP (remove separate Jumphost subnet?)

Open the 101-azurefirewall-sandbox template linked in the issue and inspect how the jumphost, public IP, and subnet are currently defined. Confirm the intended Windows/Linux options and DNAT-based SSH/RDP behavior with maintainers; done means the requested template scope is agreed and the sample reflects it.

Written by the indexing model from the issue text.