Varnish removes Public IP from X-Forwarded-for

Question

I am facing an issue where varnish is not sending Intermediary proxy IP or Public IP in a particular case. Scenario is as below :

Some Hotel / Company has squid proxy configured and all traffic for Internet is routed via Squid.
User accessing my company's site first hits the Load Balancer then Varnish & then Apache
Apache is configured with mod_geoip. The code on my site does the Country redirection based on the IP address.

Problem :

When an user (Behind that squid proxy) accessing my company's website behind Load Balancer -> VARNISH -> Apache - Here apache gets only Internal IP (His Private IP) & Load Balancer Internal IP as X-forwarded-for and Hence the IP based redirection FAILS!

In Apache logs (Configured to log X-Forwarded-IP) I see that Users Private IP & then My Load Balancers Private IP.

172.10.5.10, LoadBalancerIP - - [.......]

The same user when accesses another site which does NOT have Varnish, hits Load Balancer -> Apache - Here apache gets Users Private IP & Users Public IP as X-forwarded-for and IP based country redirection works fine.

In Apache logs (Configured to log X-Forwarded-IP) I see that Users Private IP and then his Public IP is also logged.

172.10.5.10, PublicIP - - [.......]

My Varnish Config is as below.

       if (req.restarts == 0) {
                   if (req.http.x-forwarded-for) {
                 set req.http.X-Forwarded-For =
                     req.http.X-Forwarded-For + ", " + client.ip;
                   } else {
                 set req.http.X-Forwarded-For = client.ip;
                   }
           }

PS: I've already Google'd all links I could find and every link gives the following Varnish Config

For now to get this issue resolved, I had to bypass varnish and now website traffic is directly hitting Apache but I need to get Varnish back in place to server content from Cache and Speedy delivery.

Will appreciate if someone can guide me to how resolve this issue.

Thanks!

Hello, I've gathered Varnish logs for the above mentioned issue and have pasted @ pastebin.ca/2353444 — KeyurM

KeyurM KeyurM · Accepted Answer · 2013-04-09T11:15:36

The above mentioned issue has been resolved. Credit goes to Mithrandir @ Varnish IRC Channel. Thanks! Below mentioned changes were required to resolve the issue.

At the start of the default.vcl add :

import std;

Below " if (req.http.x-forwarded-for) " add :

std.collect(req.http.x-forwarded-for);

Do varnish configtest & reload. This should start showing the Public IP.
Below is the explanation from the documentation of vmod_std :

collect

   Prototype
          collect(HEADER header)

   Return value
          Void

   Description
          Collapses the header, joining the headers into one.

   Example
          std.collect(req.http.cookie); This will collapse several Cookie:
          headers into one, long cookie header.

Varnish removes Public IP from X-Forwarded-for

2 Answers