It depends on what you're worried about as to why you would choose drop vs. reject If you scan only that specific port, a DROP will make the IP address appear

It depends on what you're worried about as to why you would choose drop vs. reject If you scan only that specific port, a DROP will make the IP address appear unused - so if you're worried about someone scanning purely for port 22 and not anything else, a drop is the better choice. (See: nmap an unused IP address with -P0 to ignore the fact there's no icmp response to show the host is alive, and you get a 'filtered') If you're worried about people that are specifically trying to find see if a service is running on your specific server, a reject + reset might be the better choice.