UFW, fail2ban, and Banning Repeat Offenders

This post explains how UFW and fail2ban work together as an intrusion response layer on a Linux server. It covers UFW rule ordering, building a custom fail2ban jail to parse Caddy's JSON access logs for suspicious HTTP status codes, and using the recidive jail to escalate repeat offenders to week-long all-ports bans.