I'm trying to configure fail2ban to block ddos attacks using the chunk shown here.
Basically it looks at all requests and if any single IP makes more than 240 requests over 60 seconds it blocks them for two days.
However all the logs in my nginx access are from 127.0.0.1 which makes the whole thing pointless.
What could cause nginx to log all traffic as coming from the server?
(I'm running Drupal on a LEMP stack with perusio's nginx config.)