ACZoom

1: first run will add all failed IPs over days or months to the watch list, but within 12 hours (default), it will clear most IPs - in your case, your IP address will be cleared, as long as you did not have any failed access in the previous 12 hours.

2:whitelist working is described in the man pages - hosts_access, hosts.allow. As soon as a line with the IP address is matched in the hosts.allow file, the rest of the hosts.allow file is ignored.

3: example blockshosts.cfg is provided in the kit. By default, it is also installed in /etc/blockhosts.cfg - all lines are commented out, and descrptions provided in case defaults need to be changed.
Alternately, you can provide command line arguments to change defaults.