Ack, I figured it out. The ban does get triggered, but it doesn't succeed because iptables doesn't work on my system -- some module isn't properly compiled for the kernel. Thanks for helping me figure this out!