Default chain does not block ssh traffic about docker-fail2ban

[crazy-max]

You right, if fail2ban is attached to DOCKER-USER chain instead of INPUT, the rules will be applied only to containers. This means that any packets coming into the INPUT chain will bypass these rules that now reside under the FORWARD chain. So sshd jail will not work as intended. You can create another container to attach fail2ban to INPUT chain for example. I will add a note about this, thanks for your input!

[crazy-max]

@jribal Check this section. This is an easy workaround, but I think we can improve the configuration of the iptables-multiport action and use only one container.

[jribal]

I'm no fail2ban or iptables expect, from what I read multiport allows to block more than the port attacked. I tried to block all ports on failure and I still had my "already banned", maybe you can do better.

My use case is using your container as a regular fail2ban installed on host. Except for tests or really specific setup, I don't see why would somebody wants to reject only traffic coming to "docker network" excluding host.

For me INPUT should be default but it depends on which behavior you expect.