There’s an excellent post over at Debian Grimoire which gives a simple recipe to defend against SSH brute force attacks using Shorewall, including a whitelist port-knock in case you manage to lock yourself out. Very useful!