Need an option - if it isn't there ...

[BenKenobi]

On the addresses I block I use 'any' I don't care what port they're from or going to.

[Bob.Dig]

Looks okayish. Toggle the eye-icon on top for some more info and check your aliases, what they actually contain.

[BenKenobi]

I've been doing that - it was adding another brute force source that showed me the IP was already blocked, I was also still receiving 'spam' from blocklisted IP's and ranges which I should not be. This has stopped since I introduced the !source into the NAT rule so far. Far too many IP's to list here but the aliases do contain what I expect.

Sources in Japan are being particularly problematic as are a few via some proxies that seek to bypass GEOIP, takes time to identify them. I'd post some server logs but I keep them pretty clean to make reviewing easier. I guess I could drop the !source and demonstrate that bad actors are able to bypass the firewall block rules.

[Bob.Dig]

Post a picture of one of your NAT rules, the full page. Just to make sure. And a picture of your firewall rules again, this time with the eye enabled.

[BenKenobi]

not possible to show all the rules NAT first

[BenKenobi]

and the rules -

[Bob.Dig]

No, I meant only one of your NAT-Rules, but fully, the whole page.
When it comes to your firewall rules that should block, none has done it. Look at my screenshot, how it should look like (I have IPv6 disabled).