I understood the comment as “leave the port open to ssh, to easily allow fail2ban to hit the ip’s before they get through your full port range.” But thanks for the elaborate answer :)

I agree, what you described is much more work ;)

By all means, I am no expert, but isn’t it “just” the fail2ban?

Hey someone spending money on toilets is good for the GDP! Is the correct response to that…