I am also having the same problem. It appears this option has no effect. For example, I added a user “zephyrs” under Brute Force Protection -> Immediately block the IP of users who try to sign in as these usernames. I then tried to log in as zephyrs. Nothing happens. I can login normally.