ACCEPT   net            fw              tcp     22      -          -            3/min:3

#       RATE LIMIT      You may rate-limit the rule by placing a value in
#                       this column:
#
#                               <rate>/<interval>[:<burst>]
#
#                       where <rate> is the number of connections per
#                       <interval> ("sec" or "min") and <burst> is the
#                       largest burst permitted. If no <burst> is given,
#                       a value of 5 is assumed. There may be no
#                       no whitespace embedded in the specification.

# Create the Whitelist chain
iptables -N SSH_WHITELIST

# Block after three failed attempts per minute
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

# Less than four? Accept
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j ACCEPT

# Whitelist (repeat for each host...or create a mask)
iptables -A SSH_WHITELIST -p tcp --dport 22 -s ${WHITELISTED_HOST} -m recent --remove --name SSH -j ACCEPT

ACCEPT   net            fw              tcp     22      -          -            3/min:3

Limit:info:SSH,3,60   net    fw    tcp   ssh