I hunted for the answer to this for quite awhile. @Munir (in the comments on the first answer) pretty much has it. To make sure that the edits endure package upgrades, don't edit /lib/systemd/system/fail2ban.service, instead use systemd's override mechanism. E.g. create a file /etc/systemd/system/fail2ban.service.d/override.conf. In that file, put
That causes shorewall.service to be added to both Requires and After (in addition to what might be specified in /lib/systemd/system/fail2ban.service), and won't be over-written in the event of fail2ban being upgraded.
In my case, I already had a private reprepro repository set up, so I created a package that inserts this file (and also adds my standard fail2ban configuration at /etc/fail2ban/jail.d/local.conf) and has a package dependency on fail2ban and shorewall. Call the package f2b-shorewall. All I have to do to get this going on a server is install f2b-shorewall, and it will pull in fail2ban and shorewall, with my standard fail2ban jail config already in, leaving only the need to configure shorewall (which is typically going to be different for each server anyway).