have problem with iptables in the part of ssh

Question

I have blocked all connection with iptables and allowed only the loopback:

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

next I want to allow only ssh connections, and also I want to record the IP address of each attempt to access port 22 using the recent module.then I want to to see if that IP address has attempted to connect 2 or more times within the last 60 seconds, and if not then the packet is accepted:

iptables -A INPUT -p tcp --dport 22 -m recent --set --name ssh --rsource
iptables -A INPUT -p tcp --dport 22 -m recent ! --rcheck --seconds 60 --hitcount 2 --    name ssh --rsource -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT 
iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT 
iptables -A INPUT -p tcp --sport 22 -j ACCEPT 
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

the problem that probably didn't write it right so can someone show me whhat is my problem

Answer 1

You mean... something like ....

iptables -N BADGUY
iptables -t filter -I BADGUY -m recent --set --name badguys

iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --set
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds 300 --hitcount 6 -j BADGUY
iptables -A INPUT -i $OUTS -p tcp --syn --dport ssh -m recent --name ssh --rcheck --seconds  30 --hitcount 2 -j DROP

?

You may also want to look at fail2ban wich does exacly what you want.