I'm responsible for a server that serves a single service (ssh) over the internet via port-forwarding through a firewall.
The ssh service login is limited to encryption-key only (no passwords allowed).
Several times a week I see the following sort of firewall log (slightly obfuscated of course):
[UFW BLOCK] IN= OUT=eth0 SRC=192.168.x.x DST=18.104.22.168 LEN=48 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=TCP SPT=22 DPT=29364 WINDOW=14600 RES=0x00 ACK SYN URGP=0
The source-port is always 22, and the destination IP is always something overseas (Korea, in this case) that appears to be malicious.
I've got the server fairly locked down, but I don't know enough about the SSH and TCP protocols to be confident, and I don't like the fact that it looks like my server is trying to contact a stranger. This sort of communication never happens during a legitimate ssh session.
Should I be concerned? Is there anything else strange about that log that my eyes haven't spotted?
Edit: I've tried a few simple things (like attempted password auth) to reproduce the blocked connection using an ssh client, with no success. Would be nice if I could reproduce it.