You should not put this alongside your site, at least not sharing resources. You should apply forwarding rules to separate this into a different vlan or vpc (ip

You should not put this alongside your site, at least not sharing resources. You should apply forwarding rules to separate this into a different vlan or vpc (ip based routing for instance) and completely isolate this from your site, while the two ssh destinations would be indistinguishable from the outside, preferably behind a load balancer with a firewall to mitigate ddos attacks and just log different attack types