This blog posts explains the whole thing: https://centos.tips/fail2ban-behind-a-proxyload-balancer/
I have no idea if using .htaccess rules would be better than this solution, I just know that this one works.
And, it's possible this is https, which would render the packet inspection useless.