One of my e-commerce websites gets heavy traffic from Indonesia but we don’t run our service to Indonesia. So I create a Cloudflare firewall rule and block the country Indonesia.
The rule will not fire either because it’s not in the right order or because they are going around Cloudflare. It’s most likely the latter and you’ll need to make sure your server firewall only accepts Cloudflare connections from these addresses IP Ranges