diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
index 4a036125..3c082e37 100644
--- a/modules/services/fail2ban.nix
+++ b/modules/services/fail2ban.nix
@@ -13,19 +13,17 @@ in {
       enable = true;
       ignoreIP = [ "127.0.0.1/16" "192.168.1.0/24" ];
       banaction-allports = "iptables-allports";
-      jails = {
-        DEFAULT = ''
-          blocktype = DROP
-          bantime = 6h
-          findtime = 15m
-        '';
-        # Harsher defaults for sshd because it's all key based. Auth failures
-        # are less likely to be legit here.
-        sshd = ''
-          bantime = 24h
-          findtime = 1h
-        '';
+      bantime-increment = {
+        enable = true;
+        maxtime = "168h";
+        factor = "4";
       };
+      jails.DEFAULT = ''
+        maxretry = 5
+        blocktype = DROP
+        bantime = 1h
+        findtime = 1h
+      '';
     };
 
     # Extra filters