Selfhosted

sorry, this is kinda like a firewall, but protecting websites, so many vulnerabilities are filtered out. it does not protect you 100% percent (nothing does). it might be hard to setup, in that case there is an option to use waf as a service, i.e. - cloudflare has such offering, maybe there are others as well. i have looked into vultr - they seem to offer only a "usual" type of firewall, not http/application based.

For the limit : basically you need to ask yourself how many connection someone if able to do in a second to your server. As an example, my limit is always 15. A bit high but I'm sure I'm not blocking a legitimate one (either from myself or someone else)

For the ssh port : it's true, but trust me you'll be happy to change for something random like 5927 because you'll have far less bit trying to connect or probe your ip, thus your logs won't be cluttered!

It would be security theatre if it was done for security. I'm not doing it for security, though - it's for my sanity when checking the logs. Unrestricted SSH simply attracts too many bots and the failed logins make it impossible to quickly grasp a picture of what's happening.

In regards to limits - this is my rule file for iptables on my lemmy instance:

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:LOG_DROP [0:0]
:LOG_ACCEPT [0:0]

-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --mask 255.255.255.255 --rsource
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 600 --hitcount 20 --name DEFAULT --mask 255.255.255.255 --rsource -j LOG_DROP
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -m recent --set --name HTTPS --mask 255.255.255.255 --rsource
#-A INPUT -p tcp -m tcp --dport 443 -m state --state NEW -m recent --update --seconds 600 --hitcount 600 --name HTTPS --mask 255.255.255.255 --rsource -j LOG_DROP
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j LOG_DROP

-A LOG_ACCEPT -j LOG --log-prefix "[ACCEPTv4]: " --log-level 7
-A LOG_DROP -j LOG --log-prefix "[DENYv4]: " --log-level 7
-A LOG_ACCEPT -j ACCEPT
-A LOG_DROP -j DROP
COMMIT

This is very much a WIP, I'm going to implement some ddos protection as soon as I get some spare time.

It does not increase security per se but it does limit the amount of bots trying to connect to your server. At least it will make your log a bit less cluttered with random garbage.

Also installing something like fail2ban might be a good idea. Or even better would be to block all ssh connections except from a specific ip address (whitelist). This of course depends whether you can trust your ip to stay the same, or if you can still log in through some other interface if necessary.