> > > > /var/log/fail2ban.log is showing that it's working: > > I have seem similar odd behaviour with f2b with other filters. > Try to uninstall the package > fail2ban-systemd > and stop and start fail2ban again. > This might change its behavior to the better. > The fail2ban-systemd package configures fail2ban to use systemd journal for log input. The OP can see that it is detecting the transgressions, so the input side of things is not the issue. What they appear to be having problems with is the banning process. Personally, I don't use 'firewallcmd-ipset' for banaction, I use 'iptables-multiport'. But the OP needs to look at what exactly is happening to the firewall configuration when an IP is banned. P.