for example:table filter { chain INPUT { proto tcp dport ssh mod state state NEW @subchain "SSH" { mod recent update seconds 300 hitcount 5 DROP; mod recent set NOP; } }}