We have an AWS EC2 instance running behind a standard ELB load balancer.
Is it possible for iptables to block HTTPS access from certain IPs, using the X-Forwarded-For IP address header info?
This rule works for http, but not https:
iptables -I fail2ban-<name> 1 -p tcp --dport <port> -m string --algo bm --string 'X-Forwarded-For: <ip>' -j DROP
I can modify AWS ACL's to block at the load balancer stage, but you can only have 20 rules per ACL, so this isn't really an option.
Can iptables be set up to block ALL connections from an X-Forwarded-For IP address outside the load balancer? So if we detected an attack or suspicious pattern of requests on port 443, the host could be banned from connecting at all?
Is there a dynamic way to block requests at the Apache level?