fail2ban + nftables Как настроить?

В jail.local

[DEFAULT]
banaction = nftables[type=multiport]
banaction_allports = nftables[type=allports]
chain = input

[dovecot]
enabled = true

filter  = dovecot[mode=aggressive]

port    = pop3,pop3s,imap,imaps,submission,465,sieve

logpath = /var/log/dovecot-info.log
banaction = %(banaction_allports)s
action = nftables[name=dovecot]
bantime = 60m
maxretry = 3
findtime = 3m

По регэкспу фильтр работает

Лог дебаг включил, там всё без ошибок

# fail2ban-client status dovecot
Status for the jail: dovecot
|- Filter
|  |- Currently failed: 0
|  |- Total failed:     0
|  `- Journal matches:  _SYSTEMD_UNIT=dovecot.service
`- Actions
   |- Currently banned: 0
   |- Total banned:     0
   `- Banned IP list:

Подскажите куда копать.