How to avoid admin account to be blocked for all ip's by failed attemps to login?
The answer can be found in this article

https://www.karelbemelmans.be/2015/04/reverse-proxy-configuration-for-drupal-7-sites/


Adding these lines to settings.php solves the issue:

$conf['reverse_proxy'] = TRUE;
$conf['reverse_proxy_addresses'] = array('127.0.0.1');
$conf['reverse_proxy_header'] = 'HTTP_X_FORWARDED_FOR';


Added these lines, in the flood table of the drupal site database, every failed login request is logged with the real ip the request came from.

The real problem, indeed, was not lying in the failed login attemps, but in linking all the attemps to the loopback address. Looking at the flood table in drupal database, I could see every request under the ip 127.0.0.1, which is wrong and causes any request from any user (and any ip) to be blocked if anyone from any ip tried to login with wrong passwords. Linking attemps to their right ip makes the drupal flood protection working as expected, that is blocking attemps only from the ip which tried to login with wrong password.