1 files changed, 14 insertions, 0 deletions

diff --git a/usecases/server/fail2ban.nix b/usecases/server/fail2ban.nix
index 3870a32..74266f7 100644
--- a/usecases/server/fail2ban.nix
+++ b/usecases/server/fail2ban.nix
@@ -6,5 +6,19 @@ inputs:
   services.fail2ban = {
     enable = true;
     ignoreIP = [ config.topology.mainVpn.subnet ];
+
+    # Remove when backported:
+    # https://github.com/NixOS/nixpkgs/pull/270864
+    banaction-allports = "iptables-allports";
+
+    bantime-increment.enable = true;
+
+    jails = {
+      recidive.settings = {
+        banaction = "%(banaction_allports)s";
+        bantime = "1w";
+        findtime = "1d";
+      };
+    };
   };
 }