You won’t return any SSH error message like “login incorrect” by that - you will just plainly drop the connection attempts using the firewall. I think there’a recent forum thread about the same issue that’s titled something like “how to stop brute force attacks on your FTP server” or the like…
This looks exactly like what I wrote about in the “General Networking” forum a while ago (same wording). As cmit wrote, you won’t return any SSH error messages because the session is encrypted. The only way is to rely on the number of connection attempts in a certain time period. Since you can have 3 failed login attempts before the SSH session is closed, you will get 9 login attempts within a minute before your IP address gets banned. Of my own experience, SSH brute forcers disconnect after every login attempts (their IP address will therefore be banned after the third login attempt).
