What do blocked IP addresses see?
They see a blank 403 page with this message specifying that their IP address has been banned:



The block is done at the application level. Drupal inserts a record into the blocked_ips table which is referenced upon bootstrapping; if a match is found the above page is shown.

I've not heard a module that does this at the OS level. Considering the variety of environments it would have to accommodate, and the potential harm of giving an application OS-level blocking (e.g. Drupal blocking you could lock you out of your own server), it's likely it doesn't exist.