When a device is not reachable you can install the reverse-ssh-tunnel.service to it.
Activate it and it will connect by itself to an accessible sshd.
Then you can connect (directly or via ProxyJump
) to the device.
(Generate and) copy the ssh key over to the reversessh server:
ssh-keygen -t ed25519 && ssh-copy-id reversessh@reversessh.3t0.de