I have set up a relay with its own dynamic public IP directly on the Internet. The only port allowed on the public interface is the ORPort, and this is the way I want to keep it. However, it would be beneficial to also let this relay be reachable from my private network for management purposes. I would like both SSH and Control Port. The relay should not have Internet access through the private network.
What is the best way to achieve this? Are there security concerns with this setup?