I don't use a tunnel normally and no I don't use port 22 :) You can simply configure an nginx stream to forward ingress on port 443 directly to home. This is how enterprise L4 load balancing is handled. Youll want to enable the HAPROXY protocol so you can use client IPS to do L7 rate limiting.