Thanks for the suggestion ! I looked into it but it seems that port knocking and Single Packet AuthZ literally open the firewall and expose the port when used.

Thanks for the suggestion ! I looked into it but it seems that port knocking and Single Packet AuthZ literally open the firewall and expose the port when used. Meaning it is great to reveal the SSH port when needed, do your business quickly and close it back when you are done. But my guess is those overlay networks need to port available all the time, so...