[techcode]

Instead of rate limiting, more than a decade ago I started simply changing SSH port from 22 to something else.

In case I needed to proxy through home, or access something like web ui for home heating system - I simply used ssh tunnel (socks localhost etc)...

Of course now all that is simply done via WireGuard/Tailscale/etc.

[lagniappe]

I'd even go one step further and say portknocking would do a lot of good too, in addition to changing the default SSH port.

[techcode]

If anyone actually does this - please have a backup for the time when either Fail2Ban or/and PortKnocking (so both) fail or lock you out.

[lagniappe]

I've never had knockd fail me, can you fill me in on what pitfall got yours to go down? Just in case.

[techcode]

Besides dummy stuff like wrong config of knockd itself - which hopefully gets ironed out during initial (local/on-prem setup).

Every now and then particular knock ports might be blocked (DROP) by cliënt side ISP/wifi/etc you happen to be using at the moment.

Or your fiber optic connection package gets a speed boost, along with being moved behind CGNAT.

OK in my case switching from cable to fiber already included ending up behind a CGNAT, but people already on that ISP actually got that 2in1 surprise.