Just set a custom port above 60000, and it’ll never get touched. Having SSH open on the WAN is wild though.. not sure why you’d do that.

If you need to access the server remotely and it needs to be WAN-facing, set up a VPN server