Adding to the good answer by @Labadadada above, my primary concern is having to do this manually. Perhaps you'd want to take a look at fail2ban. Even if you don't intend to use it as is, you can somehow try to emulate what it does by other means.
fail2ban watches your log files and matches patterns. For example, it can easily detect multiple failed logins via SSH from a specific IP. You then configure what actions to perform and after what threshold. So, for example, block all access from the IP after 5 failed SSH logins for 15 minutes. You can block the entire IP from all access, or limit the block to the specific port (22), and you can set the time after which to 'unblock' it, the threshold etc.
This gives you some kind of a combination between IDS/IPS and a firewall.
fail2ban's approach gives a really good solution because:
- you don't need to do anything manually, other than defining those filters. Although there are plenty of ready-made filters out of the box.
- you don't need to worry about your blacklist getting too long, it gets cleaned automatically.
- any persistent attack will still be mitigated, blocked and 're-blocked' if necessary.