Hi,
Do you pass your website via a CDN like Cloudflare? In that case, your server Firewall will see only Cloudflare IP addresses.
If you don't use a CDN, then perhaps the firewall didn't get applied because of the long time needed to load all the IP addresses in the IP lists.