15 minute block due to ... what?

[uwcfx]

Hi,

We currently have vBulletin running in a multi server server and we're having some issues at the moment I'll try to describe.

We got two server, lets call them server1 and server2.
Server1 runs Nginx and ourdomain but also proxies ourdomain.com/forum down to server2 which runs a regular Apache with vBulletin installed.

We've had to do some changes to make vBulletin behave like we want for example change the X-Real-IP header to Remote Host as well as X-Forwarded-For.
This makes us see the actual clients IP address in the access logs on Server2.

But, we're still seeing that if one of our users try to log in to our admin panel and types the wrong password too many times _all_ users gets blocked out and it tells us to wait 15 minutes . Our current workaround is just to truncate the strikes table but that's obviously quite ugly.

So my question is, what does vBulletin use to decide from which IP address a client actually comes from? I tried dumping the $_SERVER variable and the only thing I can see in there that shows Server1 is a GEO_IP variable.

Thoughts?

Best regards,
Lars