Why doesn't deny always work in nginx?

Question

Nginx

I'm trying to block the data centers from which the left requests to the site come, but for some reason nginx sometimes skips ip addresses. For example:
IP 64.225.1.172 DigitalOcean I
registered in the configuration

server {
include /etc/nginx/snippets/deny-ds.conf;
...
location / {
...
}

include /etc/nginx/snippets/deny-ds.conf;
...
deny 64.225.0.0/20;
...

Most blocks, but not all.
Likewise, cloudflare allows the same China to enter the site, although it states in the rules that everything except Russia is blocked.
How to block unwanted people in such a situation?

Answer 1

Wang, which is somewhere return, who doesn’t give a denydamn.