> How am I supposed to allow connections to this device in my firewall if the address is always changing?

You don't. That's what ESP/AH with PKI is for.