Added some features to evasive_module to use the correct client IP when using a reverse proxy or load balancer.

Currently only 2.x version is implemented. (Works with Apache 2.4.x)

Original mod_evasive is here.

Used regex library TRex.

DOSXForwardedForAsRemoteIP 0 or 1. Use X-Forwarded-For as remoteIP when 1. Defaults to 0.

DOSTargetedURL Regular expression of target URL, e.g. example.com:80/some.path Multiple entries requires multiple lines.

DOSUnTargetedURL Regular expression of untargeted URL, e.g. example.com:80/some.path Multiple entries requires multiple lines.

DOSLogOnly 0 or 1. Do not return 403 if 1. Defaults to 0.

You must include the Trex library when compiling the Apache2 module:

apxs -i -a -c mod_evasive24.c trex.c

If you cannot seem to get any log output, take a look at /var/log/syslog ;)

    DOSHashTableSize   3097
    DOSPageCount        5
    DOSSiteCount        50
    DOSPageInterval     1
    DOSSiteInterval     1
    DOSBlockingPeriod   120
    DOSXForwardedForAsRemoteIP 1
    DOSEmailNotify      [email protected]
    DOSSystemCommand    "su - someuser -c '/sbin/... %s ...'"
    DOSLogDir           "/var/log/apache2/mod_evasive"