Using its standard configuration, how does fail2ban block offending SSH clients?

Fail2ban is a tool that monitors the system logs for failed login attempts and blocks the offending IP addresses using netfilter rules. Netfilter is a framework that provides packet filtering, network address translation, and other functions for the Linux kernel. Fail2ban uses the iptables command to manipulate the netfilter rules and create chains of rules that match the source IP address of the attacker and drop or reject the packets from that IP address. Fail2ban can also use other firewall tools, such as firewalld or ufw, to create the netfilter rules. Fail2ban can block the IP addresses for a specified amount of time, or permanently, depending on the configuration. Fail2ban can protect various services, such as SSH, HTTP, FTP, etc., by creating different jails for each service. A jail is a set of parameters that define how to monitor a log file, how to detect a failed login attempt, how to ban an IP address, and how long to keep the ban.

Fail2ban does not block offending SSH clients by any of the other options. It does not act as a proxy in front of SSHD, nor does it modify the SSHD configuration. It does not create null routes that drop any answer packets sent to the client, nor does it modify the TCP Wrapper configuration for SSHD.

References:

How To Protect SSH with Fail2Ban on Ubuntu 20.04

How To Prevent SSH Brute Force Attacks Using Fail2ban In Linux

Fail2ban - Wikipedia

Fail2ban Manual