Thanks for your input. It is correct that a lot of ISPs/consumer grade hardware is poorly maintained. Mine is a rare exception, however: I’m running an AVM FritzBox, which are somewhat famous for still receiving updates even after 10+ years on the market. They have only recently pushed a security update my way, so I’m good enough on that front - for now. I shall consider a firewall in the future though. I hope part of your hardening SSH is changing the port number! I used to do that, but then realised that doing so will do very little. Scanning all possible ports is a matter of seconds, and SSH (unlike Wireguard) will signal to a potential attacker that it’s listening on port X instead of just remaining silent. In other words: in my eyes, it’s security by obscurity and will have very little effect. What I have done to harden SSH is: set up pubkey authentication and disable password authentication disable root login not expose my SSH port publicly; it is accessible only from my LAN and through Wireguard I have also tried out IP whitelisting (which may harden my setup against attacks from the LAN), but found it may be overkill for now. I might turn it back on just for shits and giggles.