Stop letting attackers route to you. Put your ssh server behind an onion. Do the same if you have POP/IMAP and other servers that have no reason for being accessible through transparent routing.