{
  imports = [ ./fail2ban.nix ];

  networking.firewall = {
    allowPing = false;
    logReversePathDrops = true;
    logRefusedConnections = false;
    checkReversePath = "loose";
  };
}