IP Autoblock

[douwe_yntema]

I have setup this script:

https://help.directadmin.com/item.php?id=380

I setup to block IP address after 5 failed logins. If I now see an IP address is blocked on e.g. may 7, It is accessing my server at may 11.
How is this possible?
I have setup blocked IP's never released from the list.
I checked blocked_ip.txt and the IP address is into the list.

 

[factor]

I have setup this script:
https://help.directadmin.com/item.php?id=380

that help post is 4 years old.
It's part of a bigger Help file below.

Looks like you took option 2

https://help.directadmin.com/item.php?id=527

Most do 3.

How to block IPs with Brute Force Monitor in DirectAdmin using CSF

(Updated 2018-06-12) Directadmin since version 1.39 has a built-in brute force monitor, which scan your service logs for any brute force login attempts on your system (dovecot, exim, proftpd, sshd) and sent notifications to an admin. Here you can...

help.poralix.com

 

[douwe_yntema]

I have already solved it
After 1 year 2000 blocked ip's gathered was too much for iptables. I cleared the list and restarted iptables.

 

[factor]

Just 2000

Thanks