Crowdsec will block external, public, IPs

Fail2Ban will block login attempts (ie from anywhere)

I have a similar setup with pfSense, pfBlockerNG, HAProxy, etc, but I keep F2B running on my DMZ server in case something is ever compromised as it’ll block / slow down anyone trying to move around the network.