rework doc, shorewall, add fail2ban