If you're using Digital Ocean, you can set a firewall rule via the droplet web interface, that's quick to do. Otherwise just a simple iptables does the trick.
Edit: if you have a static public IP, of course
Using an alternative connection to activate the protocol is probably the only reasonable defense:
* An https service that can enable a port for connections from an IP for a limited time (which has some security implications too since it would need root access, or to trigger something with root access)
* Something built into KLO hardware, or software provided by your provider (including something simple like turn on the firewall a few minutes after boot, and using the reboot trigger and connecting in that brief window.. as long as you don't mind your server down - probably ok as an emergency recovery strategy)
* Some form of port knocking
What I’m envisaging is: I pay somebody, make an account on their site and add 2FA, and then they give me a server with a static IP and handle the auth. Then all I have to do is to whitelist that static IP.
Ideally it would function as both an HTTP proxy and an SSH proxy; like a ‘secure web portal’
They have a cloud offering in beta where they'll manage the proxy/bastion.
Variable port knocking ie a different sequence tied to rules can help expose compromised networks making up the internet. Say you port knock from your mobile phone, use one port knocking sequence, if port knocking from a different internet connection use a different port knocking sequence. This can help highlight those networks with taps, but the identity of who is behind the tap can still remain a mystery, unless you set other traps. You also need to trust your devices, which no one can legally do as copyright prevents people from examining the code on their chips and some OS'es like Windows. NSA still provide the tools for examining code for free https://www.nsa.gov/resources/everyone/ghidra/ but as always Resource Burning is something to take seriously when trying to secure your systems. Sometimes its best to view servers as disposable, so automation can be your friend even simple PXE boots can be useful. Its also worth noting you can run at least two different ADSL connections down the same copper wire, they do here in the UK at least, most people dont know this, but the TV & film streaming services use this, some ISP supplied routers can give this away if you examine the backup config files.
I tie the Pi to my home router via OpenVPN and use https://freedns.afraid.org/ for dynamic DNS to send calls to. It has worked fine for four years now. The Pi runs a one liner from a cronjob every 15 mins or so. The TTL for the DNS entry is very short and the DHCP lease is something like 24 hours plus also I think it tends to renew the last one used reasonably reliably. I don't bother monitoring that. I could write the cronjob result to a local log I suppose.
More things can go wrong than the tiny window that might exist when the DNS might be out of whack. Don't let the lack of a static IP address get in the way.