When an unauthenticated user hits a deep link, Mendix runtime intercepts the request before any application logic runs and redirects to login.html that's why your custom login action is never triggered.
fix: set the Sign-in page to your custom login page. This tells the Mendix runtime to redirect unauthenticated requests there instead of the default login.html, which will then trigger your custom login action (including your IP filtering logic).