Currently the chain just as follows: interwebz <-> UDM <-> npm <-> services.
The services are mostly run in VMs or LXCs, npm runs in docker, accompanied by one Adguard home instance and another AGH instance in an LXC.

I now want to add f2b to this whole chain.
I've installed f2b in the OS which runs docker (and therefore npm) (VM1) and also in the OS of my existing service (VM2). Both VMs use Ubuntu as their OS.

What I already figured out thru testing and reading is, that f2b in VM2 acts as expected when the jail is triggered, and sets the block. But nftables/ufw don't block connections coming from external, as they are coming thru npm.
f2b sees and uses the public IP for the checks/bans.

So now I am thinking how to solve that.

1. Keep f2b on VM2 and let it set the bans on VM1 over SSH. That's what some people do or so I've read.
2. Use f2b on VM1, let it check logs on VM2 and then set the bans. That would also be possible over SSH, I'd guess. But I didn't read up on it yet.

So, what's your opinion? How do you fine folks handle that in your environment?
Option 2 seems to be more elegant, as it would be "at the entry" and let's me easily add additional services later.
But I don't know, if that's a path worth digging in to.