REJECT needs the nft_reject kernel extension, which is unavailable on this Arch kernel (iptables-nft reports 'Extension REJECT revision 0 not supported'), so every ban silently failed. DROP works everywhere and is quieter toward attackers.