Hi @xiao - thanks for reaching out.
As eris pointed out, Hestia CP offers “Quick Install App” function:
Fail2ban is supported. You can even consider CSF as a replacement for firewallD & Fail2ban instead.
However Lupu did a pretty decent job with stock utils where he implemented ipset filter for auto-blocking custom IPs, eg. spam, TOR, proxies, bruteforcers, etc. in v1.2.0.
Don’t hesitate & switch to Hestia CP right now. You won’t regret it 