Which pair of firewall rules restrict SSH access to the source subnet 192.168.0.0/16?

Which pair of firewall rules restrict SSH access to the source subnet 192.168.0.0/16?

• A. /ip firewall filter add chain=input protocol=tcp dst-port=22 src-address=192.168.0.0/16 action=accept; /ip firewall filter add chain=input dst-port=22 action=drop
• B. /ip firewall filter add chain=input protocol=tcp dst-port=22 src-address=0.0.0.0/0 action=accept; /ip firewall filter add chain=input dst-port=22 src-address=192.168.0.0/16 action=drop
• C. /ip firewall filter add chain=input protocol=tcp dst-port=23 src-address=192.168.0.0/16 action=accept; /ip firewall filter add chain=input dst-port=22 src-address=192.168.0.0/16 action=drop
• D. /ip firewall filter add chain=input protocol=tcp dst-port=22 action=accept

Answer: (C)

To restrict SSH access to a specific source subnet, you want a two-rule sequence on the input chain: first, allow SSH from that subnet, then drop SSH from all other sources. SSH uses TCP port 22, so the allowance must explicitly match protocol tcp and destination port 22 with the source-address 192.168.0.0/16. Because rules are evaluated top to bottom, the accept rule will permit traffic from that subnet and stop further processing for those packets; any other source won’t match the first rule and will reach the second rule, which drops SSH (destination port 22). This ensures only hosts from 192.168.0.0/16 can reach SSH, while everyone else is blocked. The other described approach fails because it either checks a different port (for example, port 23, which is not SSH) or uses a drop rule without a preceding allow for the intended subnet, which would either block SSH entirely or not properly restrict access as intended.

To restrict SSH access to a specific source subnet, you want a two-rule sequence on the input chain: first, allow SSH from that subnet, then drop SSH from all other sources. SSH uses TCP port 22, so the allowance must explicitly match protocol tcp and destination port 22 with the source-address 192.168.0.0/16. Because rules are evaluated top to bottom, the accept rule will permit traffic from that subnet and stop further processing for those packets; any other source won’t match the first rule and will reach the second rule, which drops SSH (destination port 22). This ensures only hosts from 192.168.0.0/16 can reach SSH, while everyone else is blocked.

The other described approach fails because it either checks a different port (for example, port 23, which is not SSH) or uses a drop rule without a preceding allow for the intended subnet, which would either block SSH entirely or not properly restrict access as intended.