[Service]
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=read-only
ProtectSystem=full
RuntimeDirectory=fail2ban
RuntimeDirectoryMode=0750
ReadWritePaths=-/etc/ufw
CapabilityBoundingSet=CAP_AUDIT_READ CAP_DAC_READ_SEARCH CAP_NET_ADMIN CAP_NET_RAW