Hi, I just saw a blog post talking about the ipt_recent module: http://blog.andrew.net.au/2005/02/17#ipt_recent_and_ssh_attacks Would it make sense to add support for this to firehol? Thanks! Chris