ACZoom

Config looks ok - assuming on FTP needs to blocked (config allows all SSH connections through - they will never be blocked).

Since it did block the FTP from the .161 address, it should unblock it. It will unblock only if someone connects to FTP again after 1 hour, and from some address that is not 11.11.11.11 or 127.0.0.1 or 203.218.211.161 - if only one of these addresses is trying FTP, it will never be unblocked.

If that is the case, then the option of running cron every hour, just for cleanup, will work.

ssh connections will never run blockhosts, given above config.