If you set up Cloudflare Tunnel, you don't even need to be set up to accept any incoming connections. With Access, you can even run SSH through that tunnel. You can then setup your firewall to drop any incoming packets for non-established connections, closing a significant hole for DoS attacks and such.