Even on a random port (well I picked port ___22) I get random SSH attempts.

My solution is convoluted: On my NAS I have a PHP form that accepts a password, when it's correct, set a flag (in the form of touching a file), and every minute a cronjob runs a bash script to check for the existence of the file: if it exists, then run a python script to talk UPnP to my home router to tell it to forward port ___22 to my NAS' port 22.

Hmm, probably running a VPN server, like WireGuard, makes more sense..