Why Can I Still Access an IP After Fail2ban Has Banned It?

Since you’re using Nginx with Cloudflare in front, be aware that Fail2ban might see only the internal IP from Cloudflare instead of the real external IP. The connection essentially appears to come from the Cloudflare servers rather than the actual user, which means the ban might not apply as expected. You may need a more advanced method of blocking, like checking HTTP headers directly.

Make sure to check the iptables or nftables commands being used, along with your jail.conf. They play a significant role in determining what gets blocked and what doesn't.

Fail2ban generally blocks specific IPs and port combinations. If it's not configured to block specific ports, it might only be preventing access to the service that triggered the failure instead of the entire service stack.

It can be tricky with Docker because it modifies iptables when a container is started. The rules Docker adds can take precedence over what Fail2ban tries to implement, so you might not be blocking access as intended.

Fail2ban doesn’t actually block traffic itself. What it does is execute specific ban commands when it detects repeated failures. You should check the `banaction` settings in your Fail2ban configuration to make sure they’re set up correctly for your environment. If the commands it’s meant to run aren't applicable, Fail2ban can't enforce the ban properly. Also, look into your logs for any clues on that.