UX improvements.

web/src/components/FirewallComponent.tsx

@@ -386,6 +386,16 @@ export function FirewallComponent() {
             permissive (safe default while you're getting started).
           </p>
 
+          {currentWan && !currentExtraPorts.some((p) => p.port === 22) && (
+            <Alert variant="warning">
+              <AlertCircle className="h-4 w-4" />
+              <AlertDescription className="text-xs">
+                Strict mode is active but SSH (port 22) is not in your allowed ports.
+                You may lose remote access if you don't have another way in.
+              </AlertDescription>
+            </Alert>
+          )}
+
           {!editingWan ? (
             <div className="flex items-center gap-3">
               {currentWan ? (