Are SSH destination and source ports identical (symmetric ports)?

Question

When I connect to SSH I use port 22 as destination, but when the reply comes back, does it come in on port 22 as well? Or is the client source port randomly assigned as in other TCP communication?

If set up a firewall allowing outbound traffic to port 22 - Do I also need to allow incoming traffic on port 22?

Answer 1

The client SSH port is randomly assigned, as in most client/server systems over TCP/IP.

Were the client port fixed, you would not be able to open multiple SSH connections from the same client IP address, as the connections would be indistinguishable on an IP protocol level. The client port number is the only piece that makes the connection unique (client IP, server IP and server port being the same).

You do not need to allow the incoming traffic though. There is only one outgoing connection in SSH (the responses from the server come over an existing connection).