Is there something like Apache "deny from ip" in haproxy?
You can drop an IP at the tcp level by creating an ACL and then using connection reject if the ACL is matched:
You could also set up a 403 backend and send them to that if you want to do it at the HTTP level:
These ACLs can be pretty flexible, and you can make it so multiple conditions within an ACL, or multiple ACLs within the action have to be met. More at http://haproxy.1wt.eu/download/1.5/doc/configuration.txt .