Your [Internal Server IP] has been blacklisted!

Please bear with me, this is going to be long.

First of all, I’m not even sure if the problem I’m up against (the entire www has been blocked from accessing my blog) is WP Simple Firewall’s fault.
I’m still trying to find the culprit here.

OK, I’ve got 3 security-related plugins installed.
1. WP Security Login Notification: Simply sends notifications whenever a user logs in or fails to connect.
It’s harmless and in no way does it conflict with other plugins, I’m positive.

2. WP Simple Firewall obviously.
and
3. IP Blacklist Cloud.

Now last night, I logged in to my blog and immediately received the standard “A user has logged in, etc” email.
What I didn’t notice at the time -and this is vital– is that the *system* didn’t record my real IP [2.xxx.xxx.xxx]
I was identified as “192.168.1.87” which as it turned out is the host’s server internal IP.
Every other detail was correct (User Name, email Address, Timestamp, User Agent, http Referrer).

A few hours later, a bot attempted to log in (typical brute-force attack).
Its IP was ALSO identified as “192.168.1.87” and as a consequence was banned!
And with it, the entire world wide web!
It appears that everyone (admin, users, plain visitors) is falsely recognised with the same IP regardless of their country.

Host’s customer care told me to whitelist the said IP.
The problem is that I don’t see any text file (containing IPs) anywhere in the …/plugins/wp-simple-firewall folder.
I did locate the .htaccess file (in a different path) though and added an “allow from 192.168.1.87” line thinking it would circumvent the block.
It didn’t.

This is extremely frustrating. I’m retracing my steps trying to narrow down the culprits.
The last plugin I updated was (and I say this because it involves log-in forms etc) OpenID.
Judging by the last modification date (1? hour before the brute force login attempt), maybe it has something to do with it.

As a last resort, I’m willing to uninstall all 3 security-related plugins. Provided it doesn’t ruin anything of course.
Should I just go ahead and DELETE the respective folders?
[Again, I can only access the site only through cPanel and FTP]

Thank you.