Comment by notpushkin

fwknop is a bit lower risk though. If all an attacker can do is open a port, they’ll still have to exploit OpenSSH.