I close down everything on the home gateway box but one publickey from one ip (hardened cloud server) with secure ciphers and protocol 2 only. Non-standard port

I close down everything on the home gateway box but one publickey from one ip (hardened cloud server) with secure ciphers and protocol 2 only. Non-standard port. Cloud server acts as a jump box, only allowing login from lan ips (requiring vpn first). This is, in no small part, because of the awful quality of most isp-issued router/firewall combos.