SSH_CHECK.ipt

iptables -N SSH_CHECK 
# iptables -N SSH_ATTACKED

iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_CHECK 

# iptables -A SSH_CHECK -m recent --set --name SSH 
# iptables -A SSH_CHECK -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j SSH_ATTACKED
# 
# iptables -A SSH_ATTACKED -j LOG --log-prefix "SSH attack: " --log-level 7 
# iptables -A SSH_ATTACKED -j REJECT

iptables -A SSH_CHECK -m recent --set --name SSH --rsource
iptables -A SSH_CHECK -m recent --update --seconds 300 --hitcount 4 --name SSH --rsource -j LOG --log-prefix "SSH blacklisted "
iptables -A SSH_CHECK -m recent --update --seconds 300 --hitcount 4 --name SSH --rsource -j DROP