Our website recently faced a lot of DOS type of attacks. In order to prevent we are making an attempt to make use of the mod QOS (http://mod-qos.sourceforge.net/index.html).

At a high level, we configured it with the below lines of code

<IfModule mod_qos.c>
    SetEnvIf Request_URI ^/ LimitHits
    QS_ClientEventLimitCount 100 100 LimitHits
    QS_ErrorResponseCode  429
</IfModule>

which in short blocks a user if he crosses a threshold of 100 requests in 100 seconds.

The problem happens that it blocks all the users when any user crosses the threshold.

While investigating the matter, we understood that our organization's infrastructure has a load balancer that forwards the actual IP address of the user in the X-Forwarded-For header. So we changed the QOS config to below lines

<IfModule mod_qos.c>
    SetEnvIf Request_URI ^/ LimitHits
    QS_ClientIpFromHeader X-Forwarded-For ## <--Added this line
    QS_ClientEventLimitCount 100 100 LimitHits
</IfModule>

The problem is Mod QOS says that this header does not exist! Upon further investigation, we understood that our IT infra has one more configuration which is RemoteIpHeader config which looks like -

RemoteIPHeader X-Forwarded-For

This conf suggests that Remote IP is in the connection object which must be natively available to mod_qos. Why is mod_qos is NOT taking this remote IP rather than the IP of the load balancer and thus misunderstanding all users as one?

We also added QOS logs which

CustomLog logs/qsaudit_log "client_id= %a %h %u %t \"%r\" %>s %b %T \"%{content-length}i\" %k \"%{User-Agent}i\" \
           %{mod_qos_cr}e %{mod_qos_ev}e %{mod_qos_con}e %{QS_SrvConn}e %{QS_AllConn}e \
           id=%{UNIQUE_ID}e %{QS_ConnectionId}e %{mod_qos_user_id}e %{QS_Country}e #%P"

We are able to see the value of %a and %h in logs properly. So if mod_qos understands the remote IP properly while writing logs why it does not understand while blocking users separately. The below are some of the logs (masked to hide actual IPs)

client_id= 10.47.xx.xxx 10.47.xx.xxx - [11/Aug/2021:09:01:08 +0000] "GET /about/index HTTP/1.1" 200 11202 1 "-" 0 "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.66 Safari/537.36"            - - - 1 1            id=YROR1CFBUkiNV6zl2Ro4FAAAAE0 16286724688868767706293 - - #6293