I am seeing Fail2Ban blocks for ssh connection attempts on a ports that I don't have configured to allow ssh connections from.

Is this just seeing the attempts even though there is no way to actually use those ports?

Example:

Mar 28 23:18:30 ulterius sshd[18292]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=23.228.245.151  user=root
Mar 28 23:18:31 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:33 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:35 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:37 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2
Mar 28 23:18:39 ulterius sshd[18292]: Failed password for root from 23.228.245.151 port 3355 ssh2

IPtables are not setup to allow a connection to SSH on port 3355. So any attempt would be denied. but the first line seems to have me wondering if it is still getting though?

#  Allow SSH connections
#  The -dport number should be the same port number you set in sshd_config
-A INPUT -p tcp -m state --state NEW --dport 2222 -j ACCEPT

is the section in my IPtables related to ssh.

_________________
Kevin a.k.a. Dweeber

your iptables accepts incoming connections TO port 2222. Port 3355 in the logs above is the source port. Not the port that IP is connecting to, but the port that IP is connection FROM. This is generally a random high port, afaik.