I had the same problem with attempts from all over the world.
Since our/my needs were to allow only US based ip's into ssh (actually more restricted than that)
we created a table of US cidr's and made that entry into pf.conf to filter some noise out of the system.
If the attempt was not from a US ip then it was dropped first.
Of course you then must update that file occasionally. Speed was not affected as pf searches table files rapidly..
|