Make the NetBird SSH redirect port configurable so a host's own sshd stays reachable on port 22 over the overlay #8595

Before posting

• I searched existing discussions and issues for similar requests.
• I checked the documentation to confirm this is not already supported.
• This is a product idea or enhancement request, not a support question.
• I removed or anonymized sensitive details from examples and screenshots.

Product area

NetBird SSH

Problem or use case

Problem

When the NetBird SSH server is enabled, the client installs a DNAT rule that rewrites
TCP port 22 on the peer's NetBird address to 22022, where the embedded server listens.
Nothing in NetBird binds port 22, but the rule means that on a host already running
OpenSSH, <netbird-ip>:22 always reaches NetBird SSH. The host's sshd is still reachable
on its LAN and public addresses, but not over the overlay, whichever SSH client is used.

On Linux servers I want both:

• the existing sshd on port 22 over the overlay, for my normal keys, Ansible, scp, rsync
  and so on, and
• NetBird SSH (with its JWT login) available on another port.

Today the only choice is to turn NetBird SSH off for the peer
(--allow-server-ssh=false), which removes the redirect.

Current behaviour (client)

• client/internal/engine_ssh.go calls AddInboundDNAT(addr, TCP, 22, 22022) with
  hardcoded ports. The DNAT rule matches only traffic that arrives on the NetBird
  interface and is addressed to the NetBird IP.
• The firewall backends (iptables, nftables, userspace) already take both ports as
  parameters, so only the caller is fixed to 22.

Proposed solution

A client setting, netbird up --server-ssh-redirect-port <port>:

Scope:

• A new config field, plus an optional field in the daemon's SetConfigRequest and
  GetConfigResponse.
• Changing the port goes through the daemon's privilege gate (root or admin only). It
  decides which overlay port is diverted, and whether the host's sshd becomes reachable
  from peers.
• No management or protocol change. The filter sees the port after the rewrite, and
  netbird-ssh policies already allow 22022, as do TCP/22 policies via the native SSH
  companion rule.
• Clients reach a moved server with ssh -p 22000 peer, which the generated ssh_config's
  banner detection picks up, or with netbird ssh -p 22000 peer.

Open questions

1. Is a per-peer client setting the right place, or should this be an account- or
   peer-level setting in management that is pushed to the client?
2. Flag name: --server-ssh-redirect-port, or something shorter such as
   --ssh-port?

Alternatives or workarounds considered

No response

Community impact and priority

Deployment type: selfhosted

Examples from other tools or products

No response

Security, privacy, and compatibility considerations

No response

Implementation ideas

No response

Are you willing to help?

Yes, I can submit a PR if the approach is accepted.

Additional context

No response