Written 9 Sep 2026. This is a how-to, not a product card.

fail2ban can wait

ufw and house-network SSH first. fail2ban is not a reason to open port 22.

Failed guesses on the leftover box are a peek: see if anyone guessed the password. The weekend job is still turn on a simple firewall and keep SSH on the house network. A jail that bans IPs does not replace those two.

When the jail can wait

When ufw is on and port 22 is not forwarded. When lastb is a short list of you. Not because a forum said every SSH box needs fail2ban on day one. The later walk, after those habits are boring, is slow down password guesses on SSH.

What next

Weekend path: SSH from the couch. Tick Lab plan after the login works. Don't punch a hole: NAT is why SSH stays inside.

Optional: house firewall vs a later jail as a sandbox in ByteRush — same Labthrift passkey as Plan. Skip if you just want to keep reading.

Skip

Skip fail2ban this weekend.
Skip a camera or a SIEM for a lastb list. That is a camera can wait.
Skip forwarding port 22 “because fail2ban will catch them.”

Sources

Firewall: ufw. Peek: lastb. Later jail: fail2ban how-to. Lessons: ByteRush.

Also on this topic

A firewall box can waitufw is enough. A Protectli waits. A camera can waitlastb is a peek. A Wyze waits. Turn on a simple firewallAllow OpenSSH, then turn on ufw. See if anyone guessed the passwordPeek with lastb. Don't buy a camera. Slow down password guesses on SSHLater, after ufw is on and the login habit is boring.