How to cut off China from access to the server?

Question

Debian

I saw in the fail2ban logs that brute-force passwords to ssh are coming from Chinese ip. Disabling SSH is not an option, how to cut off all of China from access to the server?

Answer 1

https://debian.pro/510 (iptables+geoip. Banning by country via iptables. Installing iptables-geoip/netfilter-geoip in Debian Squeeze.)
In wheezy it's even easier, see the comments srach.

Answer 2

change port from 22 to another (9245 as an example)
use port-knocking

Answer 3

You can cut the entire country through ipset, here is an approximate manul
dn.forceit.ru/iptables-ipset-country-block

Answer 4

1) Change the port
2) Install fail2ban
3) I also vote for logging in by keys =)

Answer 5

Google for the ranges of addresses assigned to China and prohibit the firewall from addressing this list.
Other ways: change the ssh port, ban the subnets that include the addresses of the villains.