>but its default config listens on all network interfaces

The default config listens on only localhost which is why it tells you to forward the port using ssh to your own machine to access it from a different machine.