Qnewbie

Let the external firewall do the job. IP-XX is weak again brute-force attack(System overloaded).

SSH login should be through VPN and alwaysauthreject=yes as 角色 C-hing said.

Restrict the extensions' ip-address when possible.