A god option is to setup a wireguard connection between workstation and servers. All traffic has to go through wireguard.
Because wireguard is UDP and only responds to valid requests, there isn't any open port from the outside. Not even ssh.
Because wireguard is UDP and only responds to valid requests, there isn't any open port from the outside. Not even ssh.
Not affiliated with Tailscale at all just shouting them out because they do make things very easy and I often recommend them to hobbyist.