diff --git a/docs/security/haproxy-host.md b/docs/security/haproxy-host.md
index ee39d0d..5246518 100644
--- a/docs/security/haproxy-host.md
+++ b/docs/security/haproxy-host.md
@@ -104,6 +104,8 @@ sudo fail2ban-client status haproxy-reject
 
 Порог: **15** reject за **10 мин** → бан **24 ч** через UFW. `ignoreip`: LAN, VPN, admin.
 
+**sshd:** `jail.d/sshd.local` — `banaction = ufw`, те же `ignoreip` (не банить admin/VPN/LAN).
+
 После `systemctl restart fail2ban` подождите 1–2 с перед `fail2ban-client status` (сокет).
 
 ### SSH (пример)
diff --git a/scripts/security/fail2ban-install.sh b/scripts/security/fail2ban-install.sh
index 09b4cc3..e265a68 100755
--- a/scripts/security/fail2ban-install.sh
+++ b/scripts/security/fail2ban-install.sh
@@ -29,6 +29,7 @@ command -v fail2ban-client >/dev/null 2>&1 || die "install fail2ban first (apt i
 install -m 0644 "$F2B_DIR/haproxy-json-reject.conf" /etc/fail2ban/filter.d/haproxy-json-reject.conf
 install -m 0644 "$F2B_DIR/haproxy-zabbix-403.conf" /etc/fail2ban/filter.d/haproxy-zabbix-403.conf
 install -m 0644 "$F2B_DIR/haproxy.local" /etc/fail2ban/jail.d/haproxy.local
+install -m 0644 "$F2B_DIR/sshd.local" /etc/fail2ban/jail.d/sshd.local
 
 log "fail2ban-regex haproxy-json-reject"
 fail2ban-regex /var/log/haproxy.log /etc/fail2ban/filter.d/haproxy-json-reject.conf | tail -8
@@ -44,4 +45,5 @@ systemctl restart fail2ban
 sleep 1
 fail2ban-client status
 fail2ban-client status haproxy-reject
+fail2ban-client status sshd
 log "done"
diff --git a/scripts/security/fail2ban/sshd.local b/scripts/security/fail2ban/sshd.local
new file mode 100644
index 0000000..84006b3
--- /dev/null
+++ b/scripts/security/fail2ban/sshd.local
@@ -0,0 +1,4 @@
+[sshd]
+enabled = true
+banaction = ufw
+ignoreip = 127.0.0.1/8 192.168.160.0/24 192.168.128.0/17 5.100.81.121