A Fail2ban ban can look successful while blocking nothing. Behind Cloudflare or another reverse proxy, the web server may receive the proxy as the TCP peer, recover a visitor address from a trusted header, write that visitor into a log, and then ask a host firewall to ...