[Service]
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=strict
RuntimeDirectory=fail2ban
RuntimeDirectoryMode=0750
ReadWritePaths=-/var/lib/fail2ban
ReadWritePaths=-/var/spool/postfix/maildrop
ReadWritePaths=-/run/xtables.lock
ReadWritePaths=-/etc/ufw
ReadWritePaths=-/var/lib/ufw
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW