iptables -N SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -j SSH_WHITELIST
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

server:/usr/src/linux# iptables -L -v
Chain INPUT (policy ACCEPT 2164 packets, 357K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0            tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: SET name: SSH side: source
    0     0 SSH_WHITELIST  tcp  --  any    any     anywhere         anywhere            tcp dpt:ssh state NEW
    0     0 ULOG       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source ULOG copy_range 0 nlgroup 1 prefix `SSH_brute_force' queue_threshold 1
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh state NEW recent: UPDATE seconds: 60 hit_count: 4 TTL-Match name: SSH side: source

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 2522 packets, 316K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain SSH_WHITELIST (1 references)
 pkts bytes target     prot opt in     out     source               destination


server:/usr/src/linux# lsmod
Module                  Size  Used by
ipt_recent              8984  3
xt_tcpudp               3328  4
ipt_LOG                 6016  0
ipt_ULOG                7940  1
iptable_filter          3200  1
ip_tables              11592  1 iptable_filter
ipt_REJECT              4352  0
xt_state                2688  4
x_tables               14340  7 ipt_recent,xt_tcpudp,ipt_LOG,ipt_ULOG,ip_tables,ipt_REJECT,xt_state
nf_conntrack_ipv4      15756  4
nf_conntrack           51784  2 xt_state,nf_conntrack_ipv4