> I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source o

> I've used fail2ban in production for many years but eventually removed it due to causing very large iptables leading high memory use and ultimately a source of instability for other services (i.e it turns into a DDoS vulnerability for the whole server). I know the usual advice then is to reduce ban time and just not have permabanning, but that seems to kind of defeat the purpose. Didn't the advice switch to using ipset a while back, precisely in the name of efficiency?