Another suggestion, thats is actually better than fail2ban, is to firewall off ALL ips EXCEPT for a few permitted ones.
Thus lets say you have a SSH server at home that you access from your vacation home (3G mobile broadband) and your work.
Your work propably have a static IP. Simple to tell the firewall to allow through packets for this IP.
3G mobile broadband Changes each Connection, but you can easly look in WHOIS which is the ISPs assigned series. For example: "18.104.22.168 to 22.214.171.124". Then you tell your firewall to let through 126.96.36.199/16 to port 22 on your server.
Even in this case you have allowed every customer on that 3G mobile operator to authenticate against your SSH server, but STILL its a HUGE security improvement, since instead of allowing the whole World to authenticate against your SSH server, you have instead limited this to only customers having a specific ISP account in one country.
Country locks are also a very good idea if you have multiple users on your SSH server but you know that all users are in a specific country. For example if you sold webhosting to them, but using a payment method that can only be used by Citizens in a specific country. Then its safer to simply lock all countries except for the countries you accept customers from.
Another step you can take is to limit the rate of login using iptables such as this :
iptables -A INPUT-p tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 3/minute --limit-burst 3 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT
using two firewall rules above limit any login attempts to 3 times a minute. modify accordingly to your needs.