Fail2Ban & Securing PBX behind router with port forwarding

This is true, but there was a router exploit floating around a year or so that allowed malicious access to your internal LAN by proxying thru the router, in which case it would appear that your router IP is doing the hacking.