A Linux engineer needs to block an incoming connection from the IP address 2.2.2.2 to a secure shell server and ensure the originating IP address receives a response that a firewall is blocking the connection. Which of the following commands can be used to accomplish this task?

In Linux iptables, the -j REJECT target is used to refuse a connection request actively. Unlike the -j DROP target, which silently drops incoming packets without sending any response to the sender, -j REJECT sends an explicit error packet (such as an ICMP destination-unreachable message or TCP RST) back to the originating IP address (2.2.2.2). This informs the sender immediately that the connection attempt was rejected by packet filtering policies. In this scenario, the administrator specifically requires the originating host to receive notification that the firewall is blocking the connection to the SSH port (--dport ssh), making -j REJECT the appropriate target command option.

A: The DROP target silently discards incoming packets, causing the originating IP address to time out without receiving an explicit firewall response notification. B: The RETURN target causes execution to stop traversing the current chain and resume at the calling chain, failing to block or respond to the connection. D: The QUEUE target passes the packet to user-space applications for inspection, rather than directly blocking the connection and returning a rejection response.

Linux man-pages project: iptables-extensions(8) man page, REJECT section.

Red Hat Enterprise Linux 8: Securing Networks, Chapter 5 "Using iptables".