I get a lot of IPs that try probing my sites so I set up a filter to ban them after a few 404 errors.But something is not working because I get a bunch of these instead:2017-06-07 01:08:37,175 fail2ban.actions: INFO   [http404] 125.64.94.206 already bannedHere are the setups:iptables -L -n:Chain INPUT (policy DROP)target     prot opt source               destination         fail2ban-http404  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-default  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-dovecot  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-sasl  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-courierauth  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-postfix  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-apache-overflows  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-apache-noscript  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-apache-multiport  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-apache  all  --  0.0.0.0/0            0.0.0.0/0           fail2ban-ssh  all  --  0.0.0.0/0            0.0.0.0/0           ufw-before-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           ufw-before-input  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-input  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-logging-input  all  --  0.0.0.0/0            0.0.0.0/0           ufw-reject-input  all  --  0.0.0.0/0            0.0.0.0/0           ufw-track-input  all  --  0.0.0.0/0            0.0.0.0/0           Chain FORWARD (policy DROP)target     prot opt source               destination         ufw-before-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           ufw-before-forward  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-forward  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-logging-forward  all  --  0.0.0.0/0            0.0.0.0/0           ufw-reject-forward  all  --  0.0.0.0/0            0.0.0.0/0           ufw-track-forward  all  --  0.0.0.0/0            0.0.0.0/0           Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         ufw-before-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           ufw-before-output  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-output  all  --  0.0.0.0/0            0.0.0.0/0           ufw-after-logging-output  all  --  0.0.0.0/0            0.0.0.0/0           ufw-reject-output  all  --  0.0.0.0/0            0.0.0.0/0           ufw-track-output  all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-apache (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-apache-multiport (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-apache-noscript (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-apache-overflows (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-courierauth (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-default (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-dovecot (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-http404 (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-postfix (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-sasl (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain fail2ban-ssh (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-after-forward (1 references)target     prot opt source               destination         Chain ufw-after-input (1 references)target     prot opt source               destination         ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:137ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:138ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:139ufw-skip-to-policy-input  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:445ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:67ufw-skip-to-policy-input  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:68ufw-skip-to-policy-input  all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCASTChain ufw-after-logging-forward (1 references)target     prot opt source               destination         LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix [UFW BLOCK] Chain ufw-after-logging-input (1 references)target     prot opt source               destination         LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix [UFW BLOCK] Chain ufw-after-logging-output (1 references)target     prot opt source               destination         Chain ufw-after-output (1 references)target     prot opt source               destination         Chain ufw-before-forward (1 references)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHEDACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 4ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 11ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 12ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8ufw-user-forward  all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-before-input (1 references)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHEDufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALIDDROP       all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALIDACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 3ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 4ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 11ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 12ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:67 dpt:68ufw-not-local  all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     udp  --  0.0.0.0/0            224.0.0.251          udp dpt:5353ACCEPT     udp  --  0.0.0.0/0            239.255.255.250      udp dpt:1900ufw-user-input  all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-before-logging-forward (1 references)target     prot opt source               destination         Chain ufw-before-logging-input (1 references)target     prot opt source               destination         Chain ufw-before-logging-output (1 references)target     prot opt source               destination         Chain ufw-before-output (1 references)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHEDufw-user-output  all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-logging-allow (0 references)target     prot opt source               destination         LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix [UFW ALLOW] Chain ufw-logging-deny (2 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ctstate INVALID limit: avg 3/min burst 10LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10 LOG flags 0 level 4 prefix [UFW BLOCK] Chain ufw-not-local (1 references)target     prot opt source               destination         RETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type LOCALRETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type MULTICASTRETURN     all  --  0.0.0.0/0            0.0.0.0/0            ADDRTYPE match dst-type BROADCASTufw-logging-deny  all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 10DROP       all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-reject-forward (1 references)target     prot opt source               destination         Chain ufw-reject-input (1 references)target     prot opt source               destination         Chain ufw-reject-output (1 references)target     prot opt source               destination         Chain ufw-skip-to-policy-forward (0 references)target     prot opt source               destination         DROP       all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-skip-to-policy-input (7 references)target     prot opt source               destination         DROP       all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-skip-to-policy-output (0 references)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-track-forward (1 references)target     prot opt source               destination         Chain ufw-track-input (1 references)target     prot opt source               destination         Chain ufw-track-output (1 references)target     prot opt source               destination         ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEWACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            ctstate NEWChain ufw-user-forward (1 references)target     prot opt source               destination         Chain ufw-user-input (1 references)target     prot opt source               destination                    tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW recent: SET name: DEFAULT side: sourceufw-user-limit  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW recent: UPDATE seconds: 30 hit_count: 6 name: DEFAULT side: sourceufw-user-limit-accept  tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22           udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:22 ctstate NEW recent: SET name: DEFAULT side: sourceufw-user-limit  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:22 ctstate NEW recent: UPDATE seconds: 30 hit_count: 6 name: DEFAULT side: sourceufw-user-limit-accept  udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:22ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:80ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:443DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:25 /* 'dapp_Postfix' */DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080DROP       udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:8080DROP       all  --  2.188.193.21         0.0.0.0/0           DROP       all  --  65.49.68.154         0.0.0.0/0           Chain ufw-user-limit (2 references)target     prot opt source               destination         LOG        all  --  0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 4 prefix [UFW LIMIT BLOCK] REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachableChain ufw-user-limit-accept (2 references)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           Chain ufw-user-logging-forward (0 references)target     prot opt source               destination         Chain ufw-user-logging-input (0 references)target     prot opt source               destination         Chain ufw-user-logging-output (0 references)target     prot opt source               destination         Chain ufw-user-output (1 references)target     prot opt source               destination         jail.conf:cat jail.conf # Fail2Ban configuration file.## This file was composed for Debian systems from the original one# provided now under /usr/share/doc/fail2ban/examples/jail.conf# for additional examples.## Comments: use '#' for comment lines and ';' for inline comments## To avoid merges during upgrades DO NOT MODIFY THIS FILE# and rather provide your changes in /etc/fail2ban/jail.local## The DEFAULT allows a global definition of the options. They can be overridden# in each jail afterwards.[DEFAULT]# ignoreip can be an IP address, a CIDR mask or a DNS host. Fail2ban will not# ban a host which matches an address in this list. Several addresses can be# defined using space separator.ignoreip = 127.0.0.1/8 208.85.207.82# bantime is the number of seconds that a host is banned.bantime  = 6000# A host is banned if it has generated maxretry during the last findtime# seconds.findtime = 6000maxretry = 3# backend specifies the backend used to get files modification.# Available options are pyinotify, gamin, polling and auto.# This option can be overridden in each jail as well.## pyinotify: requires pyinotify (a file alteration monitor) to be installed.#            If pyinotify is not installed, Fail2ban will use auto.# gamin:     requires Gamin (a file alteration monitor) to be installed.#            If Gamin is not installed, Fail2ban will use auto.# polling:   uses a polling algorithm which does not require external libraries.# auto:      will try to use the following backends, in order:#            pyinotify, gamin, polling.backend = auto# usedns specifies if jails should trust hostnames in logs,#   warn when reverse DNS lookups are performed, or ignore all hostnames in logs## yes:   if a hostname is encountered, a reverse DNS lookup will be performed.# warn:  if a hostname is encountered, a reverse DNS lookup will be performed,#        but it will be logged as a warning.# no:    if a hostname is encountered, will not be used for banning,#        but it will be logged as info.usedns = warn## Destination email address used solely for the interpolations in# jail.{conf,local} configuration files.destemail = root@localhost## Name of the sender for mta actionssendername = Fail2Ban## ACTIONS## Default banning action (e.g. iptables, iptables-new,# iptables-multiport, shorewall, etc) It is used to define# action_* variables. Can be overridden globally or per# section within jail.local filebanaction = iptables-allports# email action. Since 0.8.1 upstream fail2ban uses sendmail# MTA for the mailing. Change mta configuration parameter to mail# if you want to revert to conventional 'mail'.mta = sendmail# Default protocolprotocol = all# Specify chain where jumps would need to be added in iptables-* actionschain = INPUT## Action shortcuts. To be used to define action parameter# The simplest action to take: ban onlyaction_ = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s, chain=%(chain)s]# ban & send an e-mail with whois report to the destemail.action_mw = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s, chain=%(chain)s]              %(mta)s-whois[name=%(__name__)s, dest=%(destemail)s, protocol=%(protocol)s, chain=%(chain)s, sendername=%(sendername)s]# ban & send an e-mail with whois report and relevant log lines# to the destemail.action_mwl = %(banaction)s[name=%(__name__)s, port=%(port)s, protocol=%(protocol)s, chain=%(chain)s]               %(mta)s-whois-lines[name=%(__name__)s, dest=%(destemail)s, logpath=%(logpath)s, chain=%(chain)s, sendername=%(sendername)s]# Choose default action.  To change, just override value of 'action' with the# interpolation to the chosen action shortcut (e.g.  action_mw, action_mwl, etc) in jail.local# globally (section [DEFAULT]) or per specific sectionaction = %(action_)s## JAILS## Next jails corresponds to the standard configuration in Fail2ban 0.6 which# was shipped in Debian. Enable any defined here jail by including## [SECTION_NAME]# enabled = true## in /etc/fail2ban/jail.local.## Optionally you may override any other parameter (e.g. banaction,# action, port, logpath, etc) in that section within jail.local[ssh]enabled  = trueport     = sshfilter   = sshdlogpath  = /var/log/auth.logmaxretry = 6[dropbear]enabled  = falseport     = sshfilter   = dropbearlogpath  = /var/log/auth.logmaxretry = 6# Generic filter for pam. Has to be used with action which bans all ports# such as iptables-allports, shorewall[pam-generic]enabled  = false# pam-generic filter can be customized to monitor specific subset of 'tty'sfilter   = pam-generic# port actually must be irrelevant but lets leave it all for some possible usesport     = allbanaction = iptables-allportsport     = anyportlogpath  = /var/log/auth.logmaxretry = 6[xinetd-fail]enabled   = falsefilter    = xinetd-failport      = allbanaction = iptables-multiport-loglogpath   = /var/log/daemon.logmaxretry  = 2[ssh-ddos]enabled  = falseport     = sshfilter   = sshd-ddoslogpath  = /var/log/auth.logmaxretry = 6# Here we use blackhole routes for not requiring any additional kernel support# to store large volumes of banned IPs[ssh-route]enabled = falsefilter = sshdaction = routelogpath = /var/log/sshd.logmaxretry = 6# Here we use a combination of Netfilter/Iptables and IPsets# for storing large volumes of banned IPs## IPset comes in two versions. See ipset -V for which one to use# requires the ipset package and kernel support.[ssh-iptables-ipset4]enabled  = falseport     = sshfilter   = sshdbanaction = iptables-ipset-proto4logpath  = /var/log/sshd.logmaxretry = 6[ssh-iptables-ipset6]enabled  = falseport     = sshfilter   = sshdbanaction = iptables-ipset-proto6logpath  = /var/log/sshd.logmaxretry = 6## HTTP servers#[apache]enabled  = trueport     = http,httpsfilter   = apache-authlogpath  = /var/log/apache*/*error.logmaxretry = 6# default action is now multiport, so apache-multiport jail was left# for compatibility with previous (<0.7.6-2) releases[apache-multiport]enabled   = trueport      = http,httpsfilter    = apache-authlogpath   = /var/log/apache*/*error.logmaxretry  = 6[apache-noscript]enabled  = trueport     = http,httpsfilter   = apache-noscriptlogpath  = /var/log/apache*/*error.logmaxretry = 6[apache-overflows]enabled  = trueport     = http,httpsfilter   = apache-overflowslogpath  = /var/log/apache*/*error.logmaxretry = 2# Ban attackers that try to use PHP's URL-fopen() functionality# through GET/POST variables. - Experimental, with more than a year# of usage in production environments.[php-url-fopen]enabled = falseport    = http,httpsfilter  = php-url-fopenlogpath = /var/www/*/logs/access_log# A simple PHP-fastcgi jail which works with lighttpd.# If you run a lighttpd server, then you probably will# find these kinds of messages in your error_log:#   ALERT  tried to register forbidden variable GLOBALS#   through GET variables (attacker '1.2.3.4', file '/var/www/default/htdocs/index.php')[lighttpd-fastcgi]enabled = falseport    = http,httpsfilter  = lighttpd-fastcgilogpath = /var/log/lighttpd/error.log# Same as above for mod_auth# It catches wrong authentifications[lighttpd-auth]enabled = falseport    = http,httpsfilter  = suhosinlogpath = /var/log/lighttpd/error.log[nginx-http-auth]enabled = falsefilter  = nginx-http-authport    = http,httpslogpath = /var/log/nginx/error.log# Monitor roundcube server[roundcube-auth]enabled  = falsefilter   = roundcube-authport     = http,httpslogpath  = /var/log/roundcube/userlogins[sogo-auth]enabled  = falsefilter   = sogo-authport     = http, https# without proxy this would be:# port    = 20000logpath  = /var/log/sogo/sogo.log## FTP servers#[vsftpd]enabled  = falseport     = ftp,ftp-data,ftps,ftps-datafilter   = vsftpdlogpath  = /var/log/vsftpd.log# or overwrite it in jails.local to be# logpath = /var/log/auth.log# if you want to rely on PAM failed login attempts# vsftpd's failregex should match both of those formatsmaxretry = 6[proftpd]enabled  = falseport     = ftp,ftp-data,ftps,ftps-datafilter   = proftpdlogpath  = /var/log/proftpd/proftpd.logmaxretry = 6[pure-ftpd]enabled  = falseport     = ftp,ftp-data,ftps,ftps-datafilter   = pure-ftpdlogpath  = /var/log/syslogmaxretry = 6[wuftpd]enabled  = falseport     = ftp,ftp-data,ftps,ftps-datafilter   = wuftpdlogpath  = /var/log/syslogmaxretry = 6## Mail servers#[postfix]enabled  = trueport     = smtp,ssmtp,submissionfilter   = postfixlogpath  = /var/log/mail.log[couriersmtp]enabled  = falseport     = smtp,ssmtp,submissionfilter   = couriersmtplogpath  = /var/log/mail.log## Mail servers authenticators: might be used for smtp,ftp,imap servers, so# all relevant ports get banned#[courierauth]enabled  = trueport     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3sfilter   = courierloginlogpath  = /var/log/mail.log[sasl]enabled  = trueport     = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3sfilter   = postfix-sasl# You might consider monitoring /var/log/mail.warn instead if you are# running postfix since it would provide the same log lines at the# warn level but overall at the smaller filesize.logpath  = /var/log/mail.log[dovecot]enabled = trueport    = smtp,ssmtp,submission,imap2,imap3,imaps,pop3,pop3sfilter  = dovecotlogpath = /var/log/mail.log# To log wrong MySQL access attempts add to /etc/my.cnf:# log-error=/var/log/mysqld.log# log-warning = 2[mysqld-auth]enabled  = falsefilter   = mysqld-authport     = 3306logpath  = /var/log/mysqld.log# DNS Servers# These jails block attacks against named (bind9). By default, logging is off# with bind9 installation. You will need something like this:## logging {#     channel security_file {#         file /var/log/named/security.log versions 3 size 30m;#         severity dynamic;#         print-time yes;#     };#     category security {#         security_file;#     };# };## in your named.conf to provide proper logging# !!! WARNING !!!#   Since UDP is connection-less protocol, spoofing of IP and imitation#   of illegal actions is way too simple.  Thus enabling of this filter#   might provide an easy way for implementing a DoS against a chosen#   victim. See#    http://nion.modprobe.de/blog/archives/690-fail2ban-+-dns-fail.html#   Please DO NOT USE this jail unless you know what you are doing.#[named-refused-udp]##enabled  = false#port     = domain,953#protocol = udp#filter   = named-refused#logpath  = /var/log/named/security.log[named-refused-tcp]enabled  = falseport     = domain,953protocol = tcpfilter   = named-refusedlogpath  = /var/log/named/security.log# Multiple jails, 1 per protocol, are necessary ATM:# see https://github.com/fail2ban/fail2ban/issues/37[asterisk-tcp]enabled  = falsefilter   = asteriskport     = 5060,5061protocol = tcplogpath  = /var/log/asterisk/messages[asterisk-udp]enabled  = falsefilter   = asteriskport     = 5060,5061protocol = udplogpath  = /var/log/asterisk/messages# Jail for more extended banning of persistent abusers# !!! WARNING !!!#   Make sure that your loglevel specified in fail2ban.conf/.local#   is not at DEBUG level -- which might then cause fail2ban to fall into#   an infinite loop constantly feeding itself with non-informative lines[recidive]enabled  = falsefilter   = recidivelogpath  = /var/log/fail2ban.logaction   = iptables-allports[name=recidive]           sendmail-whois-lines[name=recidive, logpath=/var/log/fail2ban.log]bantime  = 604800  ; 1 weekfindtime = 86400   ; 1 daymaxretry = 5[wp-auth]enabled = true  port = http,https,sshfilter = wp-auth  #action = iptables-multiport[name=NoAuthFailures, port=http,https]  action = iptables-allportslogpath = /var/log/apache2/other_vhosts_access.logbantime = 12000  maxretry = 8 [http404]enabled = trueport = http,httpsfilter = http404#action = iptables-multiport[name=NoAuthFailures, port=http,https]#action = iptables-allportslogpath = /var/log/apache2/other_vhosts_access.logbantime = 300maxretry = 8http404.conf:[Definition]#failregex = <HOST> - - .*HTTP/1.1 404failregex = .*:80 <HOST> .* HTTP/1.1 404ignoreregex =Can you find the problem?
Fail2Ban fails to ban!
fail2ban