I encountered two unexpected behaviors and would like to get some advice.
Author: yangy30Created Jul 11, 2026Updated Jul 13, 2026
- I configured
banaction = nftables-allportsusing the latest version of Fail2Ban. However, I noticed that thepass2allow-ftpconfiguration appears unexpectedly. Could you please explain why this configuration is created and whether it is expected behavior?
# fail2ban-client status
Status
|- Number of jail: 1
`- Jail list: sshd
# nft list ruleset
table inet f2b-table {
set addr-set-pass2allow-ftp {
type ipv4_addr
}
set addr6-set-pass2allow-ftp {
type ipv6_addr
}
set addr-set-sshd {
type ipv4_addr
}
chain f2b-chain {
type filter hook input priority filter - 1; policy accept;
meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
}
}- I expected this parameter to block all ports, but it only applies to TCP traffic. This behavior seems inconsistent with the meaning of its name. Could you please clarify whether
nftables-allportsis intended to block all protocols or only all TCP ports?
Source: fail2ban/fail2ban