1. Create tunnel by Listener Client + Agent Server + Forwarder Client.
2. Set port forward definition 0.0.0.0,110,192.168.1.1,110,TCP in Listener Client.
3. Start up email client, set and connect to local address port, 127.0.0.1:110, same as direct connect to public ip to get email.
4. Then by reverse connection, your email pop3 server no need to expose to public.
Of course we will not open POP3 to 1 user only, you can consider another server service need a secure connection, like terminal server, vnc, those are only access by administrator.
Passwords used by Listener/ Forwarder setting are dynamic, password not stored on server. To make both listener and forwarder connect, both side user and password should match.