If Fail2ban reports a ban but the address still connects, or ufw deny appears ineffective, inspect the complete packet path rather than adding more deny rules. The usual causes are an inactive UFW ruleset, a disabled or misconfigured jail, an action using a different firewall backend, an earlier allow rule, an IPv6 connection, or a proxy/NAT/container hiding the client address.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Work from the outside in: confirm UFW is enforcing the rule, verify that the correct Fail2ban jail detected the event, identify the action and backend that installed the ban, then trace a controlled connection through the live rules. The commands below are designed to produce evidence at each stage.
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
How UFW and Fail2ban fit together
UFW is Ubuntu’s default firewall configuration tool. It is a management frontend for both iptables and nftables, not a separate packet-filtering engine. Ubuntu has used the nftables backend as the default since Ubuntu 20.10, although compatibility commands and applications may still refer to iptables.
Fail2ban is a log-driven service. A jail watches a service log, applies a filter, counts matches during a configured interval, and runs a firewall action when the threshold is reached. A “Ban” line in the Fail2ban log proves that the jail decided to ban an address; it does not by itself prove that packets from that address now encounter a DROP or REJECT rule.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
1. Confirm that UFW is active and has the intended rule
Start with the firewall that is supposed to enforce the manual deny rule. Run:
sudo ufw status
sudo ufw status verbose
sudo ufw status numberedInterpret the status output
Status: inactive: UFW rules are not enforcing a block. Enable it only after checking that you will not lock yourself out, especially over SSH:sudo ufw enable.- The rule is absent: create the required rule, for example
sudo ufw deny from 203.0.113.25, replacing the address with the one you actually intend to block. - The rule is present: note its number and position. An earlier allow rule can match the packet first.
- IPv6 is disabled in UFW: inspect
/etc/default/ufw. A deny that exists only in an IPv4 ruleset cannot stop an IPv6 connection.
Use the numbered listing to spot broad rules such as “ALLOW Anywhere” or an allowlist for the service port. Rule order matters: a terminating ACCEPT before a later deny prevents the later rule from being reached.
2. Verify the Fail2ban jail that should issue the ban
List available jails, then inspect the one protecting the service:
sudo fail2ban-client status
sudo fail2ban-client status sshdReplace sshd with the actual jail name. The detailed output includes the jail’s current failures and banned addresses. A jail that is not listed, or shows Currently failed: 0 while you are generating failures, is not observing the event you expect.
Check the jail’s four inputs
- Enabled state: confirm the jail has
enabled = true(or an equivalent enabled setting) in your local configuration. - Log source: make sure
logpathpoints to the service’s real log. On systems using systemd journals, the jail may need a journal backend rather than a nonexistent file. - Filter: current log lines must match the configured filter. Distribution updates, changed SSH wording, and application upgrades can make an old expression miss every event.
- Exclusions: inspect
ignoreip. An address in this list is deliberately exempt and will not be banned.
Review the effective settings in /etc/fail2ban/jail.local and any included configuration files. Avoid editing the vendor’s jail.conf directly; local overrides survive package updates more reliably.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Find the action and firewall backend Fail2ban is using
A jail can count a violation and print “Ban” while its action inserts a rule into a chain that your live traffic never traverses. Determine the action configured for the jail:
sudo fail2ban-client get sshd banactionThe get form is supported by current Fail2ban releases; if your version rejects it, inspect the jail definition and the corresponding files in /etc/fail2ban/action.d/. Look for an iptables action, an nftables action, or a UFW action, and note whether it targets IPv4, IPv6, or both.
Compare the configured action with live rules
sudo iptables -S
sudo ip6tables -S
sudo nft list rulesetSearch the output for a Fail2ban chain, set, or address. An iptables-compatible rule may be present even though UFW is managing an nftables ruleset, or the reverse. The names alone are not enough: identify the hook, table, chain, interface, and address family through which the connection enters.
Ubuntu’s nftables-default architecture makes backend alignment important. Choose one enforcement path for each jail instead of stacking unrelated actions. If UFW owns the policy, use an action that integrates with that policy; if you manage a native nftables ruleset, use an nftables-compatible action and verify that it inserts into a chain reached by the relevant hook.
4. Check rule order, interfaces, and packet counters
Even a correctly installed DROP can be ineffective when an earlier rule accepts the traffic or when the packet arrives through another path. Inspect UFW’s numbered rules and the complete nftables or iptables policy, including interface-specific rules and forwarding chains.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Common order and path failures
- An allowlist or broad service rule appears before the deny.
- The connection enters through a container bridge or is forwarded, while the ban was placed only in the host’s local-input chain.
- A rule matches one interface but the client arrives on another.
- A load balancer or reverse proxy connects to the host, so the host sees the proxy’s address rather than the original client.
- The client resolves the hostname to IPv6, while only IPv4 rules were examined.
Packet counters provide stronger evidence than a rule’s presence. For iptables, inspect verbose rules and counters with commands appropriate to your distribution, then repeat the test and see whether the suspected rule’s packet count increases. In nftables, sudo nft list ruleset displays counters when they are configured. A counter that remains at zero is a clue that the packet is taking another path.
5. Turn on logs and trace one controlled connection
Enable UFW logging while diagnosing:
sudo ufw logging onUbuntu’s firewall documentation notes that logging statements must be placed before a terminating ACCEPT, DROP, or REJECT rule to record the packet. Read the kernel or UFW log while making a test connection from a separate network. Do not test from the only administrative connection unless you have console or out-of-band recovery access.
For native nftables, a temporary log statement or nftrace can show each chain and verdict a packet encounters. Trace only a narrow, controlled test and remove diagnostic rules afterward; unrestricted tracing can generate substantial log volume.
A safe test sequence
- Record the client’s public IPv4 and IPv6 addresses separately. Confirm which address family the client uses for the service.
- From a different network, make one connection attempt to the protected port.
- Watch
journalctl -u fail2ban --since "1 hour ago"and the firewall log at the same time. - After the threshold is reached, verify the address appears in
sudo fail2ban-client status <jail>. - Immediately inspect the live rule or set and its counter.
- Repeat the connection and correlate the timestamp with the firewall log, trace output, and counter change.
This correlation distinguishes “the filter never matched,” “the action failed,” and “the rule matched a different packet path.”
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors6. Test IPv4 and IPv6 independently
IPv4 and IPv6 are separate address families. A block for an IPv4 address cannot stop the same client reaching the service over IPv6. Check both the UFW configuration and the underlying rules:
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
sudo iptables -S
sudo ip6tables -S
sudo nft list rulesetUse an IPv4-forced and IPv6-forced client test where available, such as the service’s client option for each address family. Confirm that Fail2ban’s action creates equivalent protection for both families, or deliberately disable one family for the service if that is your security decision. Do not assume an nftables inet table is present or complete; inspect the actual ruleset and hooks.
7. Account for proxies, NAT, load balancers, and containers
The address Fail2ban extracts from a log is only useful if it identifies the offending client at the enforcement point. A reverse proxy may log the original address in a forwarded header while the host firewall sees the proxy’s address. A NAT gateway can make many users appear as one source. A containerized service may receive traffic on a bridge and be filtered in a forwarding path rather than the host’s local-input path.
Questions to answer before banning
- Which component accepted the TCP connection first?
- Which address does that component log, and is it validated rather than copied from an untrusted header?
- Which source address reaches the Ubuntu host’s interface?
- Is the service in the host namespace, a container namespace, or behind a load balancer?
- Should the block be applied at the proxy, host, container network, or upstream gateway?
Preserving the original address requires deployment-specific proxy and application configuration. Blindly banning the address visible to the host can block an entire proxy or NAT customer base, while banning only an application-log address may never affect packets at the host firewall.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
8. Reload safely after changing a jail or action
After correcting a filter, logpath, ignore list, or action, reload the affected jail and verify the result:
sudo fail2ban-client reload
sudo fail2ban-client status <jail>If you changed the global service configuration, restart Fail2ban during a maintenance window and then check its journal:
sudo systemctl restart fail2ban
sudo journalctl -u fail2ban --since "1 hour ago"A reload can remove transient bans depending on the action and configuration. Treat the live firewall as authoritative: confirm that the expected chain or set exists after the reload, then perform the controlled test again.
Choose a remediation by failure type
| Observed failure | Most appropriate fix | Evidence to verify | Persistence concern |
|---|---|---|---|
| UFW is inactive or the deny is missing | Enable UFW after confirming administrative access, then add the correctly scoped rule. | ufw status verbose and ufw status numbered show an active policy and the rule. |
UFW configuration must be enabled at boot. |
| Jail does not see events | Correct enabled, logpath, backend, filter, or ignoreip. |
Jail status rises during a test and the Fail2ban journal records a match. | Keep overrides in local configuration files. |
| Ban is logged but no live rule appears | Fix the action name, permissions, executable path, or backend integration. | Fail2ban action output and the corresponding iptables or nftables rule appear together. | Ensure the action is recreated after service reloads. |
| Rule exists but its counter stays at zero | Correct chain, hook, interface, forwarding path, or rule order. | Tracing identifies the packet’s actual chain and a counter increments. | Firewall-management reloads must not discard the custom chain. |
| Only one address family is blocked | Add equivalent IPv6 or IPv4 protection, or intentionally disable the unused family. | Separate tests for each family fail as intended. | Check both families after reboot and policy regeneration. |
| Host sees a proxy, NAT, or bridge address | Enforce the ban at the component that sees the real client, or configure trusted address forwarding correctly. | Application, proxy, and host logs agree on the address being blocked. | Container and load-balancer configuration may regenerate rules. |
Persistence and reboot checks
A successful interactive test is not proof that the fix will survive a reboot. UFW rules are managed by UFW’s service and configuration; native nftables rules may be loaded by a separate service; container platforms can rewrite forwarding chains; and Fail2ban actions recreate bans from their own state and settings.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAfter making the change, document which component owns the rule, then perform a planned restart or reboot test. Re-run sudo ufw status numbered, sudo nft list ruleset, the relevant iptables commands, and sudo fail2ban-client status. Confirm that the jail starts, the intended action is available, and a newly generated ban reaches the live enforcement chain.
When a manual UFW deny is the wrong fix
A permanent UFW deny is useful for a known hostile address, but it is not a substitute for correcting a broken Fail2ban pipeline. Manual rules can also be too broad when addresses are shared by NAT gateways or proxies. If the source changes frequently, focus on authentication hardening, rate limits, service configuration, and a correctly integrated automated action rather than accumulating one-off addresses.
Likewise, changing from iptables to nftables solely because a command shows the word “iptables” can create a second, conflicting policy. First identify which backend UFW owns, which hooks receive the traffic, and which action inserts the ban. Align the action with that path, then prove the result with logs, counters, and a separate-network test.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →
