Hello,
What you are looking for you can get it just by setting the jails of each service, so that "block the ip on all ports, if that fails only on ftp", to consider, however, that the jail "recidive", blocks all Port for default:
[recidive]
enabled = true
filter = recidive
action =...