Thanks for the suggestion. I added the Remote IP valve and that did clean up log. I am now only seeing the remote IP like I requested. Unfortunately that did not fix my issue, blocked IP addressed are still able to get through.
I found a good article about this though which seems to answer my question. - https://centos.tips/fail2ban-behind-a-proxyload-balancer/ It looks like further config is still required with fail2ban to do some packet header inspection so it will recognize the remote IP and block it. I'll try this next -- Sent from: http://apache-guacamole-general-user-mailing-list.2363388.n4.nabble.com/
