SSH brute-force limiting using iptables

ssh-limit.sh

#!/bin/sh

iptables -F SSH_PORT_LIMIT || iptables -N SSH_PORT_LIMIT

iptables -A SSH_PORT_LIMIT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A SSH_PORT_LIMIT -p tcp -m state --state NEW -m hashlimit --hashlimit-mode srcip --hashlimit-upto 10/hour --hashlimit-burst 15 --hashlimit-name ssh -j ACCEPT
iptables -A SSH_PORT_LIMIT -j LOG --log-level info --log-prefix 'ssh-port-limit: '
iptables -A SSH_PORT_LIMIT -p tcp -j REJECT --reject-with tcp-reset
iptables -A SSH_PORT_LIMIT -j DROP

iptables -C INPUT ! -i eth1 -p tcp --dport 22 -j SSH_PORT_LIMIT || iptables -A INPUT ! -i eth1 -p tcp --dport 22 -j SSH_PORT_LIMIT