Workaround for Varnish X-Forwarded-For bug
Varnish currently has a bug that causes it to always add a new X-Forwarded-For header instead of appending when there is an existing one. This causes problems when Varnish is not the closest trusted server to every client. This workaround requires Pressflow 6.15.67 or later.
On the Varnish side
Add the following to your VCL and restart Varnish.
[...]
sub vcl_recv {
// Pipe and backend configuration here.
[...]
// Rename the incoming XFF header to work around a Varnish bug.
if (req.http.X-Forwarded-For) {
// Append the client IP
set req.http.X-Real-Forwarded-For = req.http.X-Forwarded-For ", " regsub(client.ip, ":.*", "");
unset req.http.X-Forwarded-For;
}
else {
// Simply use the client IP
set req.http.X-Real-Forwarded-For = regsub(client.ip, ":.*", "");
}
[...]
// Remaining configuration here.
}
[...]
On the Pressflow side
Add the following to the bottom of your settings.php file.
[...]
$conf['x_forwarded_for_header'] = 'X_REAL_FORWARDED_FOR';
Comments
Nov 10, 2010
(edited)
Anonymous
Mar 30, 2011
Is this workaround still required? It appears that this has been fixed in Varnish 2.1.x.
Anonymous
May 24, 2011
It appears so - I ran into this bug, this fix worked for me (a great big thanks to those who made this available, by the way).
I'm running:
CentOS 5.5
Apache/2.2.3
PHP Version 5.2.16 (utterramblings repo)
MySQL version 5.1.52 (utterramblings repo)
Varnish 2.1.5-2 (atomic repo)
For newbs like myself: that piece should go after the test for the right kind of request (/* Non-RFC2616 or CONNECT which is weird. */), but before this piece:
if (req.request \!= "GET" && req.request \!= "HEAD") { /* We only deal with GET and HEAD by default */ return (pass); }Otherwise, you won't get the right ip_address on a POST (e.g. the anonymous poll entries will show up as from 127.0.0.1)....