ok, I had to change the banaction to add the offending IP to the forward iptables chain, since the proxy server is running in a container not directly on the host. I think at least the openAI bot is taken care of for now.