Personally I don’t forward ports for anything that only I am supposed to access (such as SSH). Instead I connect to my home network via VPN and establish the connection from the inside. I just have an allow all from the VPN subnet to my main one, but you could also allow things selectively if you don’t want everything accessible via VPN. Using the VPN has the added bonus of ensuring everything is going through a secure tunnel if I’m connecting from a public network.