I'm running some unique firewall setup using various things rackspace offers (load balancer and clouds, and I've installed squid to proxy http requests through the clouds). My setup pretty much blocks all attacks other than HTTP floods. The problem is that I don't have SSH access to the Load Balancer to tell it to block attacking IPs, and by the time it reaches the cloud, the connecting IP is the load balancer's. However, the loadbalancer sends the client IP in a header. Is there some way I can set up my firewall to read (and block) ips from the header?
Using CentOS6.0 on the load balancer