[BR]: Can't get firewall bans to go into a different zone about fail2ban HOT 3 CLOSED

I tried overriding it in jail.local, but I must not be doing it right

I don't see how you were trying to override defaults (in your jail.local is nothing about banaction or even action).
But indeed setting of zone in default section would change nothing, unless this parameter supplied to the action (and it doesn't normally), see:

Moreover I don't see where the banactions set to firewalld action (some distro-include?)...

Anyway, here you go:

[DEFAULT]
zone = internal
banaction = firewallcmd-rich-rules[zone='%(zone)s']

# or simply:

banaction = firewallcmd-rich-rules[zone=internal]

(don't know which banaction you use, so for example used firewallcmd-rich-rules here)

Another way would be to overwrite it in action.d/firewallcmd-common.local:

[Init]
zone = internal

(this way it would be valid for all firewalld-* using firewalld-common include and its parameter zone).

from fail2ban.

Are you sure @sebres that is a good/valid example to use/give?
From what I see - what comes with my Centos 9's packages - banaction firewallcmd-multiport does not need/use the concept of zone - it utilizes firewalld's --direct
When I look at nftables it seems that, that _firewallcmd-multiport (via firewalld) goes only into ip filter table, creating chains (only)there.

Moreover, with my f2b version v1.0.2 seems that:
zone = public
has no effect at all - eg. with firewallcmd-rich-rules (there firewalld utilizes zones , yes) rules (nftables as a result) always go into whatever firewalld has set as the default zone (& only that zone)

Nowhere I see any action (in default configs) utilize --zone and I wonder how would that/anything work?

from fail2ban.

From what I see - what comes with my Centos 9's packages - banaction firewallcmd-multiport does not need/use the concept of zone - it utilizes firewalld's --direct

Hmm, indeed, firewallcmd-multiport and firewallcmd-allports example was not quite correct (it doesn't use parameter zone), so I updated it now.
However it was just an example to illustrate how one can supply a parameter to the action.

Basically I spoke about

There is a PR #3641, where all the actions replaced with single firewallcmd actions, that may support zone (have no idea it does that right now).

from fail2ban.