I've noticed that fail2bans iptables rules only works on *new connections meaning as long as someone continues to hammer a login (basic auth or wordpress etc. the existing connection continues to allow it.
If I pause for a few seconds the cloudflare firewall blocks access.
nginx logs the proper ip, fail2ban reports he proper ip as being banned, cloudflare also correctly has the firewall rule added showing the ip address.
I've tried using tcpkill on the ip, but that does nothing. I'm guessing the actual connection is with cloudflare and that renders cloudflare and iptables useless where connections can be reused. suggestions? probably some application layer blocking? nginx basic auth would not be rather vunerable though.
As is, all this would do is frustrate actual users while doing nothing to prevent brute force attacks. hoping I missed something.