Secure Your AI Agent's VPS: Close Port 22 Without Tailscale
To close port 22 without a VPN: put SSH behind an outbound-only tunnel with an identity check at the edge, verify the new path, then delete the old port-22 firewall rule. Nothing listens for inbound connections. No mesh VPN client has to share the laptop.
An exposed SSH port is not the likeliest way your AI agent's VPS gets owned. It is the likeliest way you lose the ability to fix the machine.
The standard recipe disagrees. Keep the SSH port shut to the world, open it to your own address, install a mesh VPN when you need to get in from anywhere. Its first half solves a smaller problem than its authors think. What I would reach for instead is Cloudflare Tunnel with Cloudflare Access in front. Not because the tunnel is clever, but because an outbound-only connection plus an identity check takes your ISP's address pool and your corporate VPN client out of the security model.