You could configure your router to forward a port other than 22 to port 22 on your mining rig. I haven't bothered with that with mine, though; I can ssh into my FreeNAS media server (or my desktop, if it's booted into Linux...can RDP into it if it's running Windows and set it to reboot into Linux) from outside and then ssh into the mining rig from there.
Yes, I posted about this earlier, but the concern is that would leave nvOC's SSH daemon open to the WAN running with a default password for those of us who don't have another SSH daemon on our LAN to use as an intermediary. Someone could wreck all sorts of havoc if they had access to a linux box on your local network to use as a launching point, so I personally would want to have my own unique password set before I'll forward any ports to nvOC. I have a feeling there would be some extra steps involved if one were to change the password for the m1 user on nvOC since oneBash runs commands that require escalation, but I'm not sure where oneBash gets the m1 user's password from when its executing commands. I'm sure OP can clarify this when he gets caught up on posts.
PS, Fullzero, I'm really liking v0017 so far. Excellent work!!