Oh wow! Thanks Black Fedora for this config guide. I have spent all day playing around with it.
I'm in tcp mode so I used tcp-request content deny instead of http-request denyand found out I needed to add tcp-request inspect-delay 5s to make it work. Does that sounds about right?
I think you're on the right track! Using tcp-request content deny along with tcp-request inspect-delay 5s in HAProxy for TCP mode is a good approach. The inspect delay gives HAProxy time to gather enough data to enforce your rule effectively. I would fine-tune the delay time as needed for the best balance between security and performance. Great job figuring this out!
JV
Nice! How do you do this to block CIDR ranges from a different header? E.g get the IP from the X-Forwarded-For header and compare against a blacklist?