nginx-http-auth我已经在 Amazon Linux 2 上设置了 Fail2Ban，使用此覆盖配置启用内置监狱：
[nginx-http-auth]
enabled = true
action = iptables[name=HTTPS, port=https, protocol=tcp]
logpath = <snip>/logs/*error*.log
findtime = 15m
bantime = 15m
maxretry = 5
动作正在触发，我得到以下条目iptables -S：
-A f2b-HTTPS -s 120.<snip>.122/32 -j REJECT --reject-with icmp-port-unreachable
但是，我可以继续从被禁止的 IP 发出新的 HTTPS 请求，这些 IP 正在接收来自 Nginx 的 401 响应。我已经从两个 IP 地址复制 - 我的手机和另一个 EC2 主机。
这是完整的输出iptables -L：（注意：Nginx 在 Docker 中运行，另外两个与本地网络隔离的容器也是如此）
Chain INPUT (policy ACCEPT)
target prot opt source destination
f2b-HTTPS tcp -- anywhere anywhere tcp dpt:https
Chain FORWARD (policy DROP)
target prot opt source destination
DOCKER-USER all -- anywhere anywhere
DOCKER-ISOLATION-STAGE-1 all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
DOCKER all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (2 references)
target prot opt source destination
ACCEPT tcp -- anywhere ip-192-168-208-2.ap-southeast-2.compute.internal tcp dpt:webcache
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target prot opt source destination
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
DROP all -- !ip-192-168-192-0.ap-southeast-2.compute.internal/20 anywhere
DROP all -- anywhere !ip-192-168-192-0.ap-southeast-2.compute.internal/20
DROP all -- !ip-192-168-176-0.ap-southeast-2.compute.internal/20 anywhere
DROP all -- anywhere !ip-192-168-176-0.ap-southeast-2.compute.internal/20
DOCKER-ISOLATION-STAGE-2 all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target prot opt source destination
DROP all -- anywhere anywhere
DROP all -- anywhere anywhere
RETURN all -- anywhere anywhere
Chain DOCKER-USER (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
Chain f2b-HTTPS (1 references)
target prot opt source destination
REJECT all -- 120.<snip>.122 anywhere reject-with icmp-port-unreachable
RETURN all -- anywhere anywhere
为什么 iptable 规则不停止 HTTPS 请求？
我是否需要以某种方式更改我的 fail2ban 配置以使其正常工作？