Blocking requests via iptables before AGH

[Barsovski]

Hi guys!
Can I use iptables to block DNS requests BEFORE AGH?

I'm using Fail2ban with a filter that gets IPs without the last octet.
If there are too many requests, the rule blocks 0/24 by next action:
iptables -I fail2ban-<name> 1 -s <ip>0/24 -j <blocktype>
In iptables rules i have many (~7k) lines for my chain "fail2ban-adguard" like:
REJECT all -- 170.231.113.0/24 0.0.0.0/0 reject-with icmp-port-unreachable

But requests from addresses on these networks continue to pass through to AGH.
In Fail2Ban logs warnings like this often appear:

2024-02-21 21:54:32,418 fail2ban.actions [226282]: NOTICE [adguard] 170.238.69. already banned
2024-02-21 21:54:32,437 fail2ban.actions [226282]: NOTICE [adguard] 170.238.71. already banned
2024-02-21 21:54:32,437 fail2ban.actions [226282]: NOTICE [adguard] 170.238.70. already banned
2024-02-21 21:54:32,438 fail2ban.actions [226282]: NOTICE [adguard] 170.238.68. already banned
2024-02-21 21:54:32,438 fail2ban.actions [226282]: NOTICE [adguard] 170.238.69. already banned
2024-02-21 21:54:32,438 fail2ban.actions [226282]: NOTICE [adguard] 170.238.71. already banned
2024-02-21 21:54:32,438 fail2ban.actions [226282]: NOTICE [adguard] 170.238.68. already banned
2024-02-21 21:54:32,438 fail2ban.actions [226282]: NOTICE [adguard] 170.238.70. already banned

How can it be? Why can requests go before AGH?