This is perfectly doable with just the ssh config, without having to use separate aliases for lan and wan or creating any extra port forwards. (But you naturally need some way to detect whether you're inside your lan or not)
~/.ssh/config, you'll want to add something like this:
Match host raspi exec "am_i_outside_of_my_lan"
In place of
am_i_outside_of_my_lan you'll want to place a command that determines whether you're inside your home network or not, and returns with 0 exit code if you're outside it, and something else otherwise.
host condition is probably self-explanatory, but the
exec condition warrants some explanation: It matches only when the given command returns with exit code 0, ie. no error.
So in other words, what this does is the
host raspi part restricts this rule to when you try to connect to the host raspi, and the
exec "am_i_outside_my_lan" further restricts it so that it only applies when you're connecting from outside of your home network. So inside your home network
ssh user@raspi does exactly what it normally would, but outside of it the rule matches and it instead does the equivalent of
ssh -p 1234 firstname.lastname@example.org.
As for what to use in place of
am_i_outside_of_my_lan, that depends entirely on your setup. I do suggest placing the commands in a separate script instead of trying to write it inline, because the quoting seems to be a bit hard to get right.
Personally, I used the following Python script to detect whether I'm inside my own network: (Since my domain name resolves to a local ip inside my own network)
#! /usr/bin/env python
import socket, sys
If you don't have a similar setup, you might have to do something else. (For example, you could look at the name of the wireless network you're connected to, or even query some what-is-my-ip service to get the external ip of the network you're connected to)