You can still use fail2ban to block unique IP addresses if you use some supporting scripting. There's an example ([1]), which will check the IP addresses by country code. If they're all the same country then you can just block the whole country.

You do not need to use firewalld, either, although this does. See the second link for something generic ([2]).

[1] https://pagure.io/firewalld-blacklist/tree/master

[2] https://www.linuxjournal.com/content/advanced-firewall-confi...