QS_ClientEventBlockCount not block IP

[Andrea Piatti]

Hi,
on 21/10/25 we had the 195.176.113.35 making requests that overcome our threshold configuration for around 6 hours. Almost all requests were towards /app/?login... with 302 response.
Checked in our logs an nothing strange or errors are found.
Tried to reproduce the issue without luck.

Our network has a firewall and a load balancer in front of our 2 proxies.
We are using Apache 2.4.59, mod_qos 11.74 and HTTP/2.
Could HTTP/2 the cause?
Do you have some advice to understand why it happened?

This is our configuration

LoadModule setenvif_module /opt/lib/libmetadata_ap_2_4.so.1
LoadModule setenvifplus_module /opt/lib/libmodsetenvifplus_ap_2_4.so.1

QS_ErrorPage /errorpages/error.html

QS_SrvMaxConnExcludeIP 192.168.114.160/28
QS_ClientEventBlockExcludeIP 192.168.114.160/28
QS_SrvMaxConnExcludeIP 192.168.115.160/28
QS_ClientEventBlockExcludeIP 192.168.115.160/28
QS_SrvMaxConnExcludeIP 192.168.115.32/28
QS_ClientEventBlockExcludeIP 192.168.115.32/28
QS_SrvMaxConnExcludeIP 192.168.114.32/28
QS_ClientEventBlockExcludeIP 192.168.114.32/28

QS_ClientEventBlockCount 10000 300
QS_SetEnvIf HTTPSESS_CREATED !QSNOT QS_Block=yes
QS_SetEnvResHeaderMatch Set-Cookie AppSession
QS_SrvMaxConnClose 85%
QS_SrvMinDataRate 75 300 666
QS_SrvMaxConnPerIP 60 500

QS_ClientGeoCountryDB /var/GeoIP2_Country_mod_qos_headless.csv
QS_ClientGeoCountryPriv LI,CH 100

SetEnvIf Request_URI ^/app/.* LimitLoginCounter
SetEnvIf Request_Method GET LimitLoginCounter_decrement
SetEnvIf Request_Method ^/login/resources/css/app.css LimitLoginCounter_decrement

SetEnvIf Remote_Addr ^192.168.114.(3[2-9]|4[0-7])$ LimitLoginCounter_decrement
SetEnvIf Remote_Addr ^192.168.114.(16[0-9]|17[0-5])$ LimitLoginCounter_decrement
SetEnvIf Remote_Addr ^192.168.115.(16[0-9]|17[0-5])$ LimitLoginCounter_decrement
SetEnvIf Remote_Addr ^192.168.115.(3[2-9]|4[0-7])$ LimitLoginCounter_decrement
SetEnvIf Request_Method POST QS_Cond=LimitLoginNow
QS_CondClientEventLimitCount 20 300 LimitLoginCounter LimitLoginNow

SetEnvIf Request_URI ^/app/.* LimitVipLoginCounter
SetEnvIf Request_Method GET LimitVipLoginCounter_decrement

SetEnvIf Remote_Addr ^10.. QS_Cond=LoginVipIp
SetEnvIf Remote_Addr ^164.14.6.. QS_Cond=LoginVipIp
SetEnvIf Remote_Addr ^193.5.216..* QS_Cond=LoginVipIp
SetEnvIf Remote_Addr ^162.23.111.32 QS_Cond=LoginVipIp
SetEnvIf Remote_Addr ^194.124.133.100 QS_Cond=LoginVipIp
SetEnvIf Remote_Addr ^46.140.160.29 QS_Cond=LoginVipIp
QS_CondClientEventLimitCount 60 60 LimitVipLoginCounter LoginVipIp

QS_SetEnvIfStatus 200 QS_Block=20
QS_SetEnvIfStatus 302 QS_Block=20
QS_SetEnvIfStatus 304 QS_Block=20
QS_SetEnvIfStatus 400 QS_Block=160
QS_SetEnvIfStatus 401 QS_Block=200
QS_SetEnvIfStatus 403 QS_Block=200
QS_SetEnvIfStatus 404 QS_Block=200
QS_SetEnvIfStatus 405 QS_Block=40
QS_SetEnvIfStatus 406 QS_Block=40
QS_SetEnvIfStatus 408 QS_Block=40
QS_SetEnvIfStatus 409 QS_Block=40
QS_SetEnvIfStatus 413 QS_Block=40
QS_SetEnvIfStatus 414 QS_Block=40
QS_SetEnvIfStatus 422 QS_Block=40
QS_SetEnvIfStatus 500 QS_Block=200
QS_SetEnvIfStatus 502 QS_Block=80
QS_SetEnvIfStatus 503 QS_Block=80
QS_SetEnvIfStatus 505 QS_Block=80
QS_SetEnvIfStatus QS_SrvMinDataRate QS_Block
SetEnvIf Request_URI ^/unblu/.* QS_Block=1

Thank you