I hesitate to mention this, as it causes heads to explode, but the problem you're describing is nicely solved with port-knocking. Might be easier than setting up the php page, etc. ...
Edit: found this guide https://www.inmotionhosting.com/support/website/ssh/how-to-u...
Looks like I could just create some bookmarks for the ports and open them sequentially.
I think overall this is a much better solution than messing with php/bash - good idea and thanks!
DNS Amplification Attacks: https://www.us-cert.gov/ncas/alerts/TA13-088A
> A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic.
DNS queries are much smaller then DNS responses. Making a huge amount of queries uses less bandwidth then uses to respond - making it a prime candidate for DDOS attacks. Look at your logs, no doubt you will see a large number of requests for various hosts. This is your system being used to attack people. Please close the port.
One thing to consider though is becoming a dns resolver for any random thing on the net. What I did for this was create a bash script that adds the visiting ip to iptables whitelist. Created an impossible-to-guess php page (pi admin uses php so it’s already installed and ready to go) which takes the REMOTE_ADDR and passes it to the bash script to add to iptables. Makes it super easy to allow ip’s when isp changes address or when visiting family/friends and they want to use it.