jail-level blocktype is ignored (action [Init] wins); it must be passed as banaction = ufw[blocktype=deny].