You can use the IPtables “recent” module to effectively limit your connections, here’s how:

To make this work, you need to have this commonly used rule (this allows previously established connections and is a normal rule in most firewalls):

iptables -A INPUT -j ACCEPT -p tcp ! –syn -s 0/0 -d (outer ip/net)

Now, set the limit:

iptables -A INPUT -p tcp -i eth0 -m state –state NEW –dport 22 -m recent –update –seconds 15 -j DROP
iptables -A INPUT -p tcp -i eth0 -m state –state NEW –dport 22 -m recent –set -j ACCEPT

Another way of limiting dictionary attacks is to limit using -m limit –limit like this:

iptables -A INPUT -p tcp –dport ssh -m limit –limit 3/minute –limit-burst 2 -j ACCEPT

Pick your poison, both great ways to slow down those annoying attempts.

You may want to read this guide for more info on SSH

Done!

Bookmark It