# sshd rate-limiting
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -m state \
            --state NEW -m recent --update --seconds 600 --hitcount 5 -j LOG \
                --log-prefix "sshd rate-limit: "
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -m state \
            --state NEW -m recent --update --seconds 600 --hitcount 5 -j DROP
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -m state \
            --state NEW -m recent --set

# sshd
$IPT -A tcp_inbound -p TCP -s 0/0 --destination-port 22 -j ACCEPT