Web Client Audit log when using nginx

[fr500]

Hi

I have a single server installation. I have fail2ban configured to lockout IP addresses in a strict manner, it works fine for pop/imap, But it doesn't for the webclient because webclient audit logs follow this format:

2018-11-02 09:49:36,002 WARN [qtp1684106402-3823:http://localhost:8088/service/soap/AuthRequest] [name=account@domain.com;oip=192.168.200.110;ua=zclient/8.8.8_GA_1728;soapId=5f4af1b7;] security - cmd=Auth; account=account@domain.com; protocol=soap; error=authentication failed for [account@domain.com], invalid password;

The problem here is that oip is the IP address of the same server.
Is there any way to correct this?

I've been trying to change the zimbra-nginx config files but they are always overwritten at zimbra restart.