Restrict access to ssh server somehow to device

Question

here is my setup:

laptop <-USBThetering-> mobile phone <-4g internet-> ... homeADSLrouter <-LAN-> server

1. Laptop's IP is 192.168.x.x
2. mobilephone internal IP is 192.168.x.y
3. mobilephone external IP is .... changes every time
4. homeADSLrouter external IP is variable also (though dyndns is used to update a specific host to point to that IP)
5. homeADSLrouter has ability to let though ssh traffic and redirect it to server
6. server has sshd server running listening on normal port

As the mobile phone's external IP changes every time, is there some mechanism still to restrict access to ssh port on the homeADSLrouter perhaps that is not based on IP but some other mechanism on top, rather than allowing all the world to be able to connect to ssh server (of course user/passwd is still a restriction but I'd prefer a little more)

Answer 1

If you are looking to secure your ssh, as Alex P mentioned, it is good to disable root for ssh and if possible just use ssh key logins instead. You might also consider installing fail2ban, which will ban any ip that has a certain number of failed login attempts.

Answer 2

You could install knockd and configure port knocking. You'd have to connect to port X Y Z before 22 opens up.