#4204·fail2ban

I encountered two unexpected behaviors and would like to get some advice.

Author: yangy30Created Jul 11, 2026Updated Jul 13, 2026
  1. I configured banaction = nftables-allports using the latest version of Fail2Ban. However, I noticed that the pass2allow-ftp configuration appears unexpectedly. Could you please explain why this configuration is created and whether it is expected behavior?
bash
# fail2ban-client status
Status
|- Number of jail:	1
`- Jail list:	sshd
# nft list ruleset
table inet f2b-table {
	set addr-set-pass2allow-ftp {
		type ipv4_addr
	}

	set addr6-set-pass2allow-ftp {
		type ipv6_addr
	}

	set addr-set-sshd {
		type ipv4_addr
	}

	chain f2b-chain {
		type filter hook input priority filter - 1; policy accept;
		meta l4proto tcp ip saddr @addr-set-sshd reject with icmp port-unreachable
	}
}
  1. I expected this parameter to block all ports, but it only applies to TCP traffic. This behavior seems inconsistent with the meaning of its name. Could you please clarify whether nftables-allports is intended to block all protocols or only all TCP ports?