I have a page that shows election results. Some people who want to see these election results will keep clicking refresh as election night goes on. I don't want to block this traffic -- but I do want to block simple ping floods etc. on my server. How should I configure fail2ban to accommodate these different specs?
It'd be both easier and more efficient to rate limit ICMP with the firewall:
iptables -I INPUT -p icmp --icmp-type echo-request -m recent --set iptables -I INPUT -p icmp --icmp-type echo-request -m recent --update --seconds 10 --hitcount 5 -j DROP
Windows doesn't support rate limiting, only block/allow.