Usually in cases like this there is a device (like a load balancer or proxy) stripping the dynatrace header. Therefore the User IP address you see is just the firewall as you mentioned.
You can find more information on how it is capturing the IP address here:
What you will need to do is configure your device to pass through the x-dynatrace header. If you dig through the doc that I sent over it will point you to the section where you can configure which headers are used or configure your own. To see this click on the link in that doc that says "change the processing order as well as to add your own headers."
Hope this helps.
The administrator of the load balancer needs to either configure it to pass one of the headers we support out of the box, or tell you the name of the header that's already being passed for the true client IP. If the header is not one we support out of the box, you would then need to add it so we pick it up. Usually, one of the ones we support is passed, but often only after you ask that this configuration change is made on the load balancer.