I have a couple of Apache 2 machines behind an HAPROXY setup, I tried to setup mod_evasive on those Apache machine while also using mod_rpaf to get the real X-FORWARDED client ip.
For some reason, mod_evasive grabs and blocks some ips (testing with ApacheBench) but some can go on and open more connections and basically DOS my servers.
any idea what can exclude one ip from the other in mod_evasive? considering the fact it's behind a proxy and that the real client ips are visible on the apache logs?
mod_evasive's definitions are the defaults when the DOSWhitelist is set to our subnet mask (192.168.. for example).
the rpaf module has the RPAFproxy_ips definition with our HAPROXY ip. any ideas?