server:~# iptables -A INPUT -p tcp --dport 22 -m recent --set --name SSH
server:~# iptables -A INPUT -p tcp --dport 22  -j SSH_WHITELIST
server:~# iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 4 --rttl --name SSH -j ULOG --ulog-prefix SSH_brute_force
server:~# iptables -A INPUT -p tcp --dport 22 -m recent --rcheck --seconds 60 --hitcount 4 --rttl --name SSH -j DROP

server:~# iptables -L -v
Chain INPUT (policy ACCEPT 7434 packets, 957K bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0            tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh recent: SET name: SSH side: source
    0     0 SSH_WHITELIST  tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh
    0     0 ULOG       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: SSH side: source ULOG copy_range 0 nlgroup 1 prefix `SSH_brute_force' queue_threshold 1
    0     0 DROP       tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh recent: CHECK seconds: 60 hit_count: 4 TTL-Match name: SSH side: source

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 8556 packets, 1307K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain SSH_WHITELIST (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     0    --  any    any     jan.bude.lan         anywhere            recent: REMOVE name: SSH side: source