5 ms·

Even better: Put the SSH port behind WireGuard/Tailscale.

• RunningDroid 4y ago
  That's basically what I do, nftables is configured to drop most* incoming traffic unless it's coming from wg0. *: with the exception of wireguard's ports, transmission's non-admin ports, etc