Protecting SSH from brute force attacks using iptables

Protecting yor SSH server from brute force attacks will reduce the chance of someone gussing your password to your server or workstation. One way of doing that is to use IPTables, another way is to change the default port your SSH server is listening on, in this artical I will be show you how to do the IPTables route.

Put the following in /etc/sysconf/iptables and /etc/sysconf/ip6tables:

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name SSH
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 --rttl --name SSH -j DROP
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT


restart iptables

/bin/systemctl restart iptables.service
/bin/systemctl restart ip6tables.service


This will drop connections after it has failed 5 times within the last 60 seconds.