I'll third this. Every single IP that I have geo-located that has attempted to get into one of my home servers/routers is coming from China. I didn't go as far as blocking all of China because I was sure that some point down the line it would cause some other random issue and I would have long forgotten blocking Chinese IP's. If I remember correctly I used fail2ban or similar software to blacklist IP's after X failed attempts. That plus moving all services to non-standard ports (save for 80/443).