Your server like your House, fail2ban like the Gate.
When too many people want enter the house they will stop at the Gate, but too too many many people at your Gate, the valid people (visit) also can't enter the house. Also the Gate/Fail2ban need the resource from your server to run.
That's why fail2ban can't stop DDoS.
Cloudflare can stop/filter invalid visit/people from their VERY BIG system/gate so valid visit/people can come to your Gate and enter to your House.
That's the way Cloudflare and Anti DDoS system works.
That's my understand
