It’s an uphill battle and one that I personally don’t think it’s worth fighting. If you’re running a service on a public address, there are going to be access a

It’s an uphill battle and one that I personally don’t think it’s worth fighting. If you’re running a service on a public address, there are going to be access attempts whether you like it or not regardless of them being legitimate or not. It’s just the nature of the wider internet. I have just learned to live with it, it will never stop. You’ll end up moving around the point where probes happen if you have a bastion, if you use tail scale, if you run fail2ban, move the service to another port, implement knocking or any other overused suggestion. The only real solution is either keeping your sshd up-to-date to minimize the risk of zerodays, moving it to a private address (and by virtue of still needing to get to it, exposing yet another service), filtering everything but a handful of addresses or just not using it. How much time do you want to sink into this, what’s your threat model, is that used bandwidth actually worth anything are the big questions I’d ask right away to inform an answer.