[sureglymop]

To go further, use a VPN that uses UDP and only allow that connection after port knocking three randomly chosen ports.

[ThePowerOfFuet]

This is way overkill when you could simply use Wireguard instead.

[sureglymop]

Not really, its just a few lines in your nftables/iptables rules. And sure, wireguard is great. It's just an underrated trick from decades ago. :)