Firewall – Blocking IP behind a load balancer

What Eric takes the long way to point you towards but doesn't actually state is that you need to authorize the source as the amazon-elb/amazon-elb-sg. If you're doing this through the AWS Management Console it will actually auto-complete when you start typing it into the source field. I operate several ELB configurations and they all allow access to 80/TCP via this security group and the static IP addresses of my monitoring systems.

To address the updated request info, you can not restrict what IP addresses can hit the ELB. This could be possible on the Apache server side if you write rules that look at the headers and make decisions to reject the page view. My way of restricting access for testing is add my static IP to the security group allowed to hit the EC2 instance via port 80/TCP and simply take the instance out of the ELB for testing.

What sort of load balancing? (are you load balancing at the network layer, the app layer, etc); also define "Doesn't work"

I'm going to go out on a limb and guess that your backend servers' NAT or route is misconfigured for your local subnet. i.e: you can hit the load balancer, and the load balancer kicks traffic to one of your servers, but the servers can't get packets back to you.

Pop open wireshark and take a look at where your TCP connection fails/stalls.

Also, PING (ICMP) and TCP are completely different beasts.