问题：

我在CentOS 8上运行fail2ban，配置了ssh和Nginx，当我执行fail2ban-client状态时，它们都显示ip 被阻止，但实际上它们并没有被Firewalld阻止。

[DEFAULT] 


ignoreip = 127.0.0.1 192.168.1.0/24


bantime = 21600


findtime = 300


maxretry = 3


banaction = iptables-multiport


backend = systemd



[sshd] 


enabled = true



[nginx-http-auth]


enabled = true


filter = nginx-http-auth


port = http,https


logpath = /var/log/gitlab/nginx/error.log



[nginx-noscript]


enabled = true


port = http,https


filter = nginx-noscript


logpath = /var/log/gitlab/nginx/access.log


maxretry = 6



[nginx-badbots]


enabled = true


port = http,https


filter = nginx-badbots


logpath = /var/log/gitlab/nginx/access.log


maxretry = 2



[nginx-nohome]


enabled = true


port = http,https


filter = nginx-nohome


logpath = /var/log/gitlab/nginx/access.log


maxretry = 2



[nginx-noproxy]


enabled = true


port = http,https


filter = nginx-noproxy


logpath = /var/log/gitlab/nginx/access.log


maxretry = 2



[gitlab]


enabled = true


port = http,https


filter = gitlab


logpath = /var/log/gitlab/gitlab_error.log

答案1：

如果实际使用firewalld，请确保使用与firewalld兼容的banaction，例如firewallcmd-ipset。