Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This might sound like a bit of a strange question, but I've just taken a sample of over 80 IPs which have failed SSH authentication, and I've mapped them using an online mapping tool.

All of them came from China / Korea... my question is how can I block a range of IPs which would stop these countries being allowed to make SSH requests to my machine, as it's just filling up my logs and wasting traffic.

I'm using shorewall as my firewall if that helps.

share|improve this question

To solve this issue people usually implement tools like sshguard or fail2ban.

Find sshguard at:
Find fail2ban at:

share|improve this answer
Fail2ban is SOOOOO easy and SOOOOO good – Pitto Jan 5 '12 at 10:54
This. You don't want to ban SSH access from 'strange foreign places' you want to block SSH access from IPs that are trying to DoS or brute force your system. – Freiheit Jan 5 '12 at 14:35
Remember to add few machines you have access to the whitelist – Hubert Kario Jan 16 '12 at 12:10
Fail2ban even work for httpd and it look promising. +1 for sharing this. – Azi Jun 20 '14 at 1:31

Use geoip. Xtables is your friend.

share|improve this answer

A generic solution for bruteforce denials is denyhosts. Check it out at

This will block any IP after a configured count of failed login attempts. It also works for FTP daemons and every other tool that comes with tcp wrapper support.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.