apache 2.2 - Block traffic behind AWS ELB

My web servers are behind ELB, I want to block traffic
from some specific user agent which is a DDOS attack. Apache always see ip address of
ELB as an end user so I tried below
attempts:

1. Blocking IP
   address at ELB level is not possible because it has limit of 20 IP addresses and IP
   addresses change at every attack.



2. Block access
   using rewrite condition, this works but if lot of hits come then server load goes beyond
   100 and all apache threads become busy in serving tons of 403 so site appears down for
   legitimate
   requests.

   
   
   
   

   RewriteCond
               %{HTTP_USER_AGENT} ^SomeThing
   
   RewriteRule ^(.*)$ -
               [F]
   




3. Block
   with mod_sec does same thing of serving 403 which create same effect as #2
   above.




4. Block packets with iptables
   string module: Block packets which have specific user agent. In this scenario iptables
   sends DROP/ REJECT to attacker, apache doesn't get signal that the connections is now
   dead and waits for a timeout which cause all apache threads in use for timeout, so this
   method is not useful
   here.

   
   
   

   iptables -I INPUT -i eth0 -p
               tcp --dport 80 -m string --algo bm --string 'user-agent: SomeThing' -j
               REJECT
   

Can
I use iptables such way that it will get IP address from first packet which has
user-agent: SomeThing and block all the next packets which has
X-Forwarded-For: someIP for 4-5 hours. I don't want to keep the
IP address blocking always as these IP Addresses can be assigned to some legitimate
users and that will be blocked.

Or is there any
other better way to handle this attack ?