So, we had a bot that was "scraping" content from us, images, videos etc. It was able to use up all available slots on apache therefor causing a DoS. Normally this is pretty simple to prevent using IPtables. The problem is our setup is more complex.
Load Balancer > Proxie > Front-End > Applications > - > Shared Assets
Our front ends do not see the "source ip" because the traffic gets sent from the load balance which then inputs a "x-forward-for" into the http header. Wondering what the best way of limiting connections via the x-forward-for are without adding much overhead, ie: mod_security