diff --git a/roles/ipt-server/handlers/main.yml b/roles/ipt-server/handlers/main.yml
index 6395812..00eb1e6 100644
--- a/roles/ipt-server/handlers/main.yml
+++ b/roles/ipt-server/handlers/main.yml
@@ -8,8 +8,22 @@
   service:
     name: ipt-firewall
     state: restarted
+  notify: Restart fail2ban if active
 
 - name: Restart IPv6 Firewall
   service:
     name: ip6t-firewall
     state: restarted
+  notify: Restart fail2ban if active
+
+# A firewall restart flushes the fail2ban chains; restarting fail2ban
+# recreates them and re-applies the active bans. Does nothing if fail2ban
+# is not installed or not running.
+- name: Restart fail2ban if active
+  shell: |
+    if systemctl is-active --quiet fail2ban ; then
+       systemctl restart fail2ban
+       echo restarted
+    fi
+  register: fail2ban_restart
+  changed_when: "'restarted' in fail2ban_restart.stdout"