If you don't have a dedicated public IP to use for the server, then an alternative would be to set up a port forwarding rule. That will do the same thing but will just use the IP address on the internet uplink. As SSH is a pretty common port to scan for, I would recommend that you lock it down so it can't be reached from anywhere except for the IP addresses of your users.  ... View more

Meraki devices are easy to work with but they're not the most flexible. Flexibility and features are inverse proportionate to ease of configuration and use. You can easily achieve the tasks it supports but it's really hard to wigle it into positions it's not made for.   The supported features sofar are: NAT your subnets to the interface IP address. NAT one external IP (from a pool) to one internal IP NAT external IP (from a pool) to a specific insde host and port. Static NAT over VPN if you need NAT over VPN and only if you ask support. You could make a wish. The NAT feature I myself wish for is rather due to the depletion of IPv4 address space and that is to be able to NAT to an IP pool that is not related to your WAN uplink.  So you could have private address space in uplink and a full /29 as a NAT subnet that is routed towards your uplink IP or vIP. ... View more