How to force IIS to use x-Forwarded-For/CF-Connecting-IP instead of c-ip for IP Restrictions?
Try to use the IIS URL Rewrite module to accomplish this, add a new inbound rule with conditions that check to see if the IP address does not match {HTTP_X_Forwarded_For}, you can then set the rule up to redirect, rewrite, or abort the request.