If Fail2ban reports a ban but the address still connects, or ufw deny appears to do nothing, trace the connection from the outside in. First prove that UFW is active and the rule exists; then verify the Fail2ban jail and its log filter; finally confirm that the jail’s action inserts a rule into the packet path your Ubuntu system actually uses. On modern Ubuntu installations that usually means checking the nftables ruleset as well as iptables-compatible output. IPv6, rule order, proxies, NAT and containers can all make a correct-looking ban ineffective.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What a “ban” that still allows connections usually means
Fail2ban is not itself a firewall. It reads service logs, counts matches with a filter and invokes an action when a threshold is reached. The action is responsible for adding a block to a firewall framework. A Fail2ban log entry such as Ban 203.0.113.25 therefore proves that the filter reached its threshold and the action was called; it does not prove that a packet from that address later traversed the rule that was created.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUFW is Ubuntu’s default firewall configuration tool. Canonical describes it as a frontend for both iptables and nftables; the nftables backend has been the default since Ubuntu 20.10. A jail configured with an iptables-oriented action can consequently write an iptables-compatible chain that is not reached by the live nftables/UFW path, depending on the release and configuration. The other common explanations are an inactive firewall, a wrong or disabled jail, an allow rule earlier in the chain, an IPv6 connection, or a proxy or container hiding the client’s address.
- UFW inactive: no UFW rule can enforce a block.
- Wrong jail: the service may log somewhere else, use a changed log format, or exempt the address through
ignoreip. - Backend mismatch: Fail2ban may update an iptables-compatible chain while traffic is evaluated by a different nftables chain.
- Path or order problem: an earlier
ACCEPT, a different interface or chain, or a container boundary can bypass the drop. - Address-family mismatch: an IPv4 rule does not stop an IPv6 connection.
- Intermediary address: the host may see a reverse proxy, load balancer or NAT gateway rather than the original client.
Do not change several layers at once. The following sequence creates evidence at each boundary and avoids guessing.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
1. Verify that UFW is enabled and the intended rule exists
Start with UFW itself, not with Fail2ban. Run:
sudo ufw status
sudo ufw status verbose
sudo ufw status numberedUbuntu’s documentation uses these commands to inspect firewall state and numbered rules. The first command should report Status: active. If it reports Status: inactive, a command such as sudo ufw deny from 203.0.113.25 has only changed UFW’s stored configuration; it is not enforcing a live block until UFW is enabled.
status verbose shows defaults and whether logging is enabled. status numbered is useful for spotting an allow rule that appears before a deny rule and for removing or reordering a specific entry. Confirm that the address is written in the correct form and that the rule applies to the port and protocol being tested. A deny aimed at one service does not block a different service unless the rule is broad enough to cover it.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Before enabling UFW on a remote host, make sure your management port has an explicit allow rule and that you have console or out-of-band recovery access. Enabling a firewall over an existing remote session can otherwise lock you out.
2. Inspect the Fail2ban jail that is supposed to ban the address
List the jails and then inspect the relevant one:
sudo fail2ban-client status
sudo fail2ban-client status sshdReplace sshd with the jail name shown on your system. The jail status should identify a current log path, a filter, the number of failures and the currently banned addresses. A ban count that rises while the service remains reachable indicates that you must inspect the action and packet path; a ban count of zero points first to logging, filtering or jail configuration.
Confirm the log path and filter
Fail2ban is log-driven. Check that logpath names the file or journal source where the service actually records failed attempts. Ubuntu services may log to systemd’s journal, a traditional file, or an application-specific location. A path that exists but has no new entries will never trigger a useful ban.
Compare recent service entries with the filter’s expected pattern. Authentication messages can change between service versions, distributions and logging formats. If the lines do not match, the jail can remain enabled while never counting the events you care about. Use the service’s own journal or log tools to establish the exact timestamp and source address before adjusting the filter.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Check exemptions and thresholds
Review the jail’s ignoreip setting. An address in that list is deliberately exempt, even if matching failures appear in the log. Also check the jail’s failure threshold and time window: a source that does not reach the configured number of matches during the configured interval will not be banned.
Inspect the effective configuration in /etc/fail2ban/jail.local and any included jail files rather than assuming a package default. After an edit, reload Fail2ban and query the jail again. A successful reload does not by itself prove that the resulting firewall rule is live; that is verified in the next steps.
3. Find out which firewall action the jail is using
Ask Fail2ban for the jail’s action where the installed version supports the query:
sudo fail2ban-client get sshd banactionAlso inspect the jail definition and the corresponding files in /etc/fail2ban/action.d/. The action may insert an iptables DROP rule, call an nftables command, use a UFW command, or perform additional checks that recreate the action when firewall state changes. The action name is more informative than the word “Ban” in the log: it tells you which rule family and chain Fail2ban intends to modify.
Do not assume that seeing an iptables command means traffic is being evaluated by the same path. Ubuntu can expose iptables-compatible commands while the kernel’s active policy is nftables. Compare the action’s implementation with the live ruleset. If the action writes to a chain that is never jumped to from the active input path, the ban can be recorded without affecting packets.
Inspect both rule representations
sudo iptables -S
sudo ip6tables -S
sudo nft list rulesetiptables -S and ip6tables -S show IPv4 and IPv6 iptables-compatible rules. nft list ruleset shows the nftables tables, chains, jumps and rules the kernel can evaluate. Look for the banned address, the Fail2ban chain name, and the chain hook or jump that connects it to incoming traffic.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
If a ban appears in iptables -S but not in the relevant nftables ruleset, or appears in a chain with no path from the interface and hook receiving the traffic, you have a backend or integration problem. Choose one coherent action that matches the firewall path managed on that host instead of stacking unrelated actions.
4. Trace rule order, interfaces and counters
A drop rule is effective only if the packet reaches it. An earlier allowlist or ACCEPT can terminate evaluation first. Rules may also differ by interface, destination port, protocol or connection state. A packet arriving through a container bridge, a VPN interface or a different public interface may never traverse the chain you inspected.
Use sudo ufw status numbered to review UFW’s order, then inspect the live iptables-compatible and nftables rules for counters. Generate a controlled connection attempt from a separate network and observe which counter increases. Testing from the server itself can follow a different path from a real external client and can produce a false conclusion.
When a counter on the suspected drop remains at zero, do not keep editing the rule. Find the preceding jump or hook that the packet actually uses. When an earlier accept counter increases, move the deny or adjust the allowlist deliberately. Preserve an emergency management allow rule while testing so that you do not remove your own access.
5. Turn on logs and nftables tracing
Enable UFW logging when you need evidence of packets reaching its rules:
sudo ufw logging onCanonical notes that logging rules must be placed before a terminating ACCEPT, DROP or REJECT rule. If logging is attached after a terminating rule, the packet will be decided before the log statement and you will see no record.
Recommended Free Tools
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
For a native nftables policy, add an appropriate log statement or use nftables’ packet tracing facility, nftrace, in a controlled maintenance window. Tracing can identify the table, chain and rule that each packet matches, including the final verdict. Remove temporary tracing after the test; leaving verbose packet tracing enabled can flood logs and impose unnecessary overhead.
Correlate three timestamps: the client’s connection attempt, the UFW or nftables packet log, and the Fail2ban service log. The Fail2ban service log is available with:
sudo journalctl -u fail2ban --since "1 hour ago"This correlation distinguishes “the filter banned it” from “the firewall dropped this particular connection.”
6. Test IPv4 and IPv6 separately
An IPv4 deny cannot block a client that resolves your hostname to IPv6 and connects over that address family. Inspect both iptables and ip6tables, and inspect nftables rules that use an inet family or an IPv6-specific table. Confirm the address family used by the test client rather than relying on the hostname alone.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRun one controlled test forced to IPv4 and another forced to IPv6 with your client’s networking tools. The exact client command varies by service, but the important result is two separately observed connections and two separately inspected rule paths. If only one family is protected, configure the jail action and UFW policy to cover both or intentionally disable the unneeded family at the host and service layers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Account for proxies, load balancers, NAT and containers
The address Fail2ban reads is the address present in the service log. Behind a reverse proxy or load balancer, that may be the intermediary’s address rather than the visitor’s. Behind NAT, many users can share one public address. In a container deployment, the host may see a bridge or node address while the application records a different forwarded address.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Banning the intermediary can either fail to stop the offending client or block every client using that intermediary. Preserving the original address requires deployment-specific configuration: the proxy must pass it safely, the application must trust only the expected proxy, and the logging format must expose the resulting client address. Do not enable a generic “trust all forwarded headers” setting merely to make Fail2ban see an address.
Likewise, a host firewall rule may not govern traffic already routed inside a container network or handled by a separate ingress firewall. Trace the packet at the layer where the service receives it and place the action in the enforcement layer that actually sees the source address.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choosing a remediation
Use the evidence you collected to select a single, testable fix. The important dimensions are backend alignment, address family, packet path, evidence and persistence.
| Observed condition | Likely correction | How to verify |
|---|---|---|
| UFW reports inactive | Enable UFW only after allowing your management access and confirming the intended policy. | sudo ufw status verbose reports active; a controlled test increments the expected rule counter. |
| Jail has no failures or bans | Correct logpath, filter, jail enablement, ignoreip, threshold or time window. |
Jail status shows new failures and a ban after a controlled, authorized test. |
| Ban exists only in an iptables-compatible chain | Align banaction with the nftables/UFW path actually traversed, or deliberately use a compatible iptables integration. |
The banned address appears in the live path shown by nft list ruleset or in a chain proven to receive the packet. |
| Drop counter remains zero | Fix rule order, interface, chain jump or destination match; check for an earlier allow. | Packet tracing or counters show the test packet reaching the intended verdict. |
| Only IPv4 is blocked | Add an IPv6 policy/action or restrict the service’s address families intentionally. | Separate IPv4 and IPv6 tests both receive the expected verdict. |
| Logs show a proxy, NAT or bridge address | Configure trusted address preservation and enforce the ban at the layer that sees the real source. | The service log, firewall log and packet capture agree on the client identity. |
Reload safely and verify persistence
- Save the current jail and firewall configuration before editing it.
- Change one variable: the action, filter, log path, rule order or address-family policy.
- Reload the affected jail or Fail2ban service using the package’s supported procedure.
- Run
sudo fail2ban-client status <jail>and confirm the jail remains enabled. - Check the action’s live rule in
iptables -S,ip6tables -Sornft list ruleset, as appropriate. - From a separate network, perform an authorized connection attempt and watch UFW logs, Fail2ban’s journal and rule counters.
- After a maintenance reboot or firewall reload, repeat the live-rule check. A configuration file that looks correct but does not recreate the chain after restart is not a persistent fix.
Fail2ban actions can include checks that reinitialize an action when firewall state changes. That behavior helps recovery, but it does not replace verification: inspect the rule after UFW reloads, service restarts and reboots.
Common mistakes that produce a false “not blocked” result
- Testing from an already established session: an existing connection may remain usable even though new connections are dropped. Close it and create a new session.
- Testing on the wrong port: a service-specific deny may leave another listener reachable by design.
- Checking only IPv4: a browser or client can silently choose IPv6.
- Looking only at Fail2ban’s log: “Ban” is an action request, not proof of a matching kernel verdict.
- Appending a second firewall stack: combining UFW, hand-written nftables rules and an unrelated iptables action can create conflicting order and persistence problems.
- Ignoring allowlists: UFW rules, Fail2ban’s
ignoreipand upstream network allowlists can all intentionally bypass a drop. - Using the server as the test client: local traffic may use loopback, a local route or a different hook from external traffic.
- Trusting forwarded addresses broadly: an attacker can forge a header unless only the known proxy is trusted.
A compact diagnostic command set
Run these commands in order, recording the output and timestamps:
sudo ufw status verbose
sudo ufw status numbered
sudo fail2ban-client status
sudo fail2ban-client status sshd
sudo fail2ban-client get sshd banaction
sudo iptables -S
sudo ip6tables -S
sudo nft list ruleset
sudo journalctl -u fail2ban --since "1 hour ago"Use the jail name that exists on your host instead of sshd. The goal is to connect one event to one rule: identify the address in the service log, confirm the jail bans it, locate the action’s live rule, prove the packet reaches that rule, and then repeat the test over every address family and network path your users can use.
Free tools Windows power users keep installed
One-click scans. No signup required.
When the problem is resolved
You have a defensible fix when UFW is active, the correct jail is reading current service events, the address is not exempt, the selected action writes to the firewall backend that receives the traffic, and a controlled external test increments the intended drop counter or produces the expected logged verdict. Repeat that validation after reloads and reboots, and document whether the policy covers IPv4, IPv6, proxies, NAT and container traffic. That evidence is more reliable than any single “Ban” line.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
