Well after read only a little.... I readed the best protection for webamin is tunnel ssh, yes is correct! but I think about en fail2ban for ssh, and created small filter for webadmin of Zentyal.
https://github.com/badapple7/Fail2ban-to-Zentyalyup, is very small but worked for me...
----
Hi to all, I'm user new of Zentyal, always configured my server with ubuntu, but zentyal is very easy, and simple !!! no have money for buy choice edition "commercial", only proved edition "development", ok, well!! to a client installed this version, I understand thatdont is sugeride for producction, but this client dont have much money y only is the server and six pcs.
Sorry for my bad english XD