Locked out of server

Support
22

Yes, I use that. But I always get the WAN-IP.
I think I need an analysis strategy to find the single client in my LAN that triggers fail2ban.