Why not both? Really, first thing is to be on top of your pure iptables config. Even better, is to realize iptables is being deprecated and it's time to learn n

Why not both? Really, first thing is to be on top of your pure iptables config. Even better, is to realize iptables is being deprecated and it's time to learn nftables. No, don't use nice little gui's or menus that abstract the data entry away for you, you need to understand how the firewall actually works. Then port change, SSH hardening in general (key + pass, google pam auth module, etc), then fail2ban, denyhosts, sshguard, tallow, etc. And all that doesn't matter if you don't see any alerts. Need a hids (I like OSSEC) and a good logging system for syslog etc alerts. Number one issue I see with servers (besides badly secured in the first place), is a bunch of logs no one ever actually looked at.