[CentOS] iptables question

I'm running fail2ban to attempt to block malicious brute-force password
dictionary attacks against ssh. They seem to be rolling through a block of ip
addresses as the source to defeat this kind of screening, so I've set some ip
addresses to be blocked in iptables. Here is the output of iptables -L (edited):

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
fail2ban-VSFTPD  tcp  --  anywhere             anywhere            tcp dpt:ftp
fail2ban-SSH  tcp  --  anywhere             anywhere            tcp dpt:ssh
RH-Firewall-1-INPUT  all  --  anywhere             anywhere           
DROP       all  --  116.10.191.0/24      anywhere           
DROP       all  --  183.136.220.0/24     anywhere           
DROP       all  --  183.136.221.0/24     anywhere           
DROP       all  --  183.136.222.0/24     anywhere           
DROP       all  --  183.136.223.0/24     anywhere           
DROP       all  --  122.224.11.0/24      anywhere           
DROP       all  --  219.138.0.0/16       anywhere           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
RH-Firewall-1-INPUT  all  --  anywhere             anywhere           
REJECT     all  --  anywhere             anywhere            reject-with icmp-ho
st-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

Chain RH-Firewall-1-INPUT (2 references)
target     prot opt source               destination        
ACCEPT     all  --  anywhere             anywhere           
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     esp  --  anywhere             anywhere           
.
.
.

Yet in my logwatch emails, I see this, long after the iptables rules are in
place to drop some ip ranges:

 --------------------- pam_unix Begin ------------------------

 sshd:
    Authentication Failures:
       root (116.10.191.166): 1 Time(s)
       root (116.10.191.167): 1 Time(s)
       root (116.10.191.170): 1 Time(s)
       root (116.10.191.173): 1 Time(s)
       root (116.10.191.179): 1 Time(s)
       root (116.10.191.182): 1 Time(s)
       root (116.10.191.186): 1 Time(s)
       root (116.10.191.199): 1 Time(s)
       root (116.10.191.203): 1 Time(s)
       root (116.10.191.211): 1 Time(s)
       root (116.10.191.219): 1 Time(s)
       root (116.10.191.223): 1 Time(s)
       root (116.10.191.226): 1 Time(s)
       root (116.10.191.228): 1 Time(s)
       root (116.10.191.237): 1 Time(s)
<snip>

 --------------------- SSHD Begin ------------------------


 Failed logins from:
 
    116.10.191.165: 4 times
    116.10.191.181: 3 times
    116.10.191.201: 4 times
    116.10.191.207: 4 times
    116.10.191.218: 4 times
    116.10.191.231: 4 times
    116.10.191.234: 3 times
    116.10.191.235: 4 times
    116.10.191.239: 4 times

If they keep going through this ip block, they will still get 255 attempts at
the root password and 1020 attempts at other login/password combinations before
they are blocked by fail2ban.

Why is this ip range still able to attempt connections? Have I done something
wrong with my address ranges, or added them in the wrong place?

thanks,
-chuck

-- 
ACCEL Services, Inc.| Specialists in Gravity, Magnetics |  (713)993-0671 ph.
                    |   and Integrated Interpretation   |  (713)993-0608 fax
448 W. 19th St. #325|            Since 1992             |  (713)306-5794 cell
 Houston, TX, 77008 |          Chuck Campbell           | campbell at accelinc.com
                    |  President & Senior Geoscientist  |

     "Integration means more than having all the maps at the same scale!"