I configured a rule in AWS WAF/ELB to allow access only from Brazil, but some IPs (example below) from other countries appear in the access.log and error.log of the EC2 instance (ubuntu + nginx). Does anyone know why this happens?

Example of the file:
{ “Name”: “XXXX-OnlyIPsBR”, “Priority”: 0, “Statement”: { “NotStatement”: { “Statement”: { “GeoMatchStatement”: { “CountryCodes”: [ “BR” ] } } } }, “Action”: { “Block”: {} }, “VisibilityConfig”: { “SampledRequestsEnabled”: true, “CloudWatchMetricsEnabled”: true, “MetricName”: “XXXX-OnlyIPsBR” } }

Rule JSON:

{ “Name”: “XXXX-ApenasIPsBrasil”, “Priority”: 0, “Statement”: { “NotStatement”: { “Statement”: { “GeoMatchStatement”: { “CountryCodes”: [ “BR” ] } } } }, “Action”: { “Block”: {} }, “VisibilityConfig”: { “SampledRequestsEnabled”: true, “CloudWatchMetricsEnabled”: true, “MetricName”: “XXXX-ApenasIPsBrasil” } }

What’s wrong with the rule