> Could you maybe explain a bit more about how one sets up OpenSSH to block brute-force login attempts with only its built-in features?

There are various ways, but you will probably want to start by investigating a combination of the below tuned for your environment :

      - PerSourceMaxStartups
      - PerSourceNetBlockSize
      - PerSourcePenalties
      - Match Invalid-User + RefuseConnection

`PerSourcePenaltyExemptList` is also worth a mention if its the sort of thing you like, we don't use it at $work as whitelisting IP ranges is not really in-line with modern security best-practice (zero trust etc.).