Support

Per the message, since this is a live site the only valid option is Enable IP Workarounds.

IP workarounds are only required on very specific servers. Namely, when you have a CDN, reverse proxy, external firewall (like Sucuri) or load balancer in front of your web server and you have not configured your web server to report the real client's IP address by parsing the X-Forwarded-For HTTP header. If IP workarounds are disabled for these servers the only reported IP address will be a private network address.

Your site seems to fall in this category. By enabling IP workarounds you will let your site "see" the real IP address of the attacker instead of the internal network address of the reverse proxy in front of your site. Therefore Admin Tools will be able to block the attacker automatically.

The GeoBlock will not work if your site does not see the real IP address of the attacker. Moreover, there are some security exceptions which get evaluated before GeoBlocking, namely anything that has to do with logging in a user. This is due to the way Joomla! itself works under the hood. The user login events precede the earliest event non-core code can hook into (the "application is initialised" event). As a result the user login security exceptions precede the main body of security checks, including Geographic IP Blocking.