super simple code to add a 24 hour IP address block for anyone who tries to ssh in 3 times and fails

iptables.sh

#! /bin/bash
/usr/bin/sudo /sbin/iptables -I INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
## if someone tries to ssh in 3x and fails, block their IP for 24 hours
/usr/bin/sudo /sbin/iptables -I INPUT -i eth0 -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 86400 --hitcount 4 --name DEFAULT --rsource -j DROP

## place in /etc/network/if-up.d/

## see all rules with:
# /usr/bin/sudo /sbin/iptables -vnL --line-numbers

## delete a rule with:
# /usr/bin/sudo /sbin/iptables -D INPUT 2