npftables blocks all incoming except a particular set of ips. any connections from those ips hit pubkey authentication.

I’ve never had a problem