Which sequence enables SSH access only from a specific network and blocks others?

Which sequence enables SSH access only from a specific network and blocks others?

• A. /ip service ssh set address=192.168.0.0/24; /ip firewall filter add chain=input src-address=192.168.0.0/24 protocol=tcp port=22 action=accept; /ip firewall filter add chain=input protocol=tcp port=22 action=drop
• B. /ip service ssh set address=0.0.0.0/0
• C. /ip firewall filter add chain=input protocol=tcp port=22 action=accept
• D. /ip service ssh disable

Answer: (A)

To allow SSH only from a specific network, both the service and the firewall must be constrained. Binding SSH to a specific address (192.168.0.0/24) ensures the service themselves won’t respond on other interfaces. Then use firewall rules that first accept TCP traffic on port 22 from that source network and afterward drop TCP traffic on port 22 from all other sources. This order guarantees that legitimate SSH from the allowed network gets through, while anything else is blocked. The other approaches fail because they either expose SSH to all addresses (listening on 0.0.0.0/0), permit SSH from any source (a blanket accept), or disable the service entirely.

To allow SSH only from a specific network, both the service and the firewall must be constrained. Binding SSH to a specific address (192.168.0.0/24) ensures the service themselves won’t respond on other interfaces. Then use firewall rules that first accept TCP traffic on port 22 from that source network and afterward drop TCP traffic on port 22 from all other sources. This order guarantees that legitimate SSH from the allowed network gets through, while anything else is blocked. The other approaches fail because they either expose SSH to all addresses (listening on 0.0.0.0/0), permit SSH from any source (a blanket accept), or disable the service entirely.