A systems administrator is required to allow only SSH access to the Linux servers from the 192.168.1.0/24 network. Which of the following iptables rules would accomplish this requirement?

Option A likely omits the source subnet specification or uses incorrect syntax, which would either allow SSH from any host or fail to match traffic correctly.

Option B correctly uses '-A INPUT -p tcp --dport 22 -s 192.168.1.0/24 -j ACCEPT' to permit SSH from the authorized subnet, then '-A INPUT -p tcp --dport 22 -j DROP' to deny all other sources. This leverages iptables sequential top-down rule evaluation - the subnet match fires first to allow authorized traffic, and the catch-all DROP blocks everything else on port 22.

Option C likely places the DROP rule before the ACCEPT rule, causing iptables to block all SSH traffic including from the 192.168.1.0/24 subnet due to first-match evaluation.

Option D likely targets the wrong chain (such as OUTPUT instead of INPUT), uses an incorrect subnet mask, or applies to the wrong protocol, failing to enforce the source-based access restriction.