Question about locking a port forward rule to a source IP

[road hazard]

How safe and secure is it to lock a port forward rule to a source IP?

I recently moved my backup server to my brother's house and on his Asus router, I opened SSH but locked the source IP to my (static) IP address. Is this fairly safe or should I add a little more security by changing the SSH port so we're not using the default one and install fail2ban? (Using Debian 12.)

Or, is locking the rule so only SSH traffic from my IP address is allowed in good enough without fear of somebody spoofing my IP?

 

[ColinTaylor]

Or, is locking the rule so only SSH traffic from my IP address is allowed in good enough without fear of somebody spoofing my IP?

That's good enough.

 

[Martinski]

How safe and secure is it to lock a port forward rule to a source IP?

I recently moved my backup server to my brother's house and on his Asus router, I opened SSH but locked the source IP to my (static) IP address. Is this fairly safe or should I add a little more security by changing the SSH port so we're not using the default one and install fail2ban? (Using Debian 12.)

Or, is locking the rule so only SSH traffic from my IP address is allowed in good enough without fear of somebody spoofing my IP?

Since you didn't mention the SSH keys specifically, I would recommend making sure to disallow "Password Login" and use *only* strong SSH keys for authentication (2048-bit RSA or Ed25119 keys). It's good to have a more robust extra layer of security, especially when SSH is open over the WAN, even if the source IP address is locked. The more barriers set up, the better, IMO.

 

[road hazard]

That's good enough.

Good to hear, thanks for the reply!

 

[road hazard]

Since you didn't mention the SSH keys specifically, I would recommend making sure to disallow "Password Login" and use *only* strong SSH keys for authentication (2048-bit RSA or Ed25119 keys). It's good to have a more robust extra layer of security, especially when SSH is open over the WAN, even if the source IP address is locked. The more barriers set up, the better, IMO.

I copied my keys over and followed your advice and disabled password login and changed the key to 2048 RSA. Thanks for the info!