In /var/log/auth.log on my server connected to the Internet I have the following:
Jul 6 10:04:17 ubuntu sshd: Connection from 126.96.36.199 port 48921 Jul 6 10:04:19 ubuntu sshd: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=softbank221111075119.bbtec.net user=root Jul 6 10:04:20 ubuntu sshd: Failed password for root from 188.8.131.52 port 48921 ssh2 Jul 7 17:00:40 ubuntu sshd: Connection from 184.108.40.206 port 4555 Jul 7 17:00:42 ubuntu sshd: reverse mapping checking getaddrinfo for host-220.127.116.11.tedata.net [18.104.22.168] failed - POSSIBLE BREAK-IN ATTEMPT! Jul 7 17:00:42 ubuntu sshd: Failed none for root from 22.214.171.124 port 4555 ssh2
And many other login attempts with different ports. I am behind a router, on which I enabled only the default ssh port (with port forwarding) for my Ubuntu server, then why are these ports in the auth.log? No DMZ enabled in router.