I'm using Amazon's ELB to load balance between servers,
When my site is under attack by bots, everything is exhausted, so here is the problem
I can't block IP addresses with Amazon's security groups, because they don't explicitly allow "deny", so deny one IP you have to allow every other IP address which is tedious.
I can't use iptables to block IP addresses because ELB obfuscates the public IP addresses and replaces them with its own IP address.
The actual IP address of the visitors can only be seen in X-FORWARDED-IP