Varnish 4 logging proxy/load balancer instead of client IP addresses

Question

So I'm trying to get client IP addresses logged under a new installation of Varnish 4 (we've been using 3 up to this point) in front of nginx and behind an AWS load balancer and can't seem to get the client IP addresses to log under varnish.

Previously in 3 we used this at the top of sub_recv():

std.collect(req.http.x-forwarded-for);
if (req.http.X-Forwarded-For)
{
    set req.http.X-Forwarded-For = req.http.X-Forwarded-For + ", " + client.ip;
} else
{
    set req.http.X-Forwarded-For = client.ip;
}

and also this on another server:

std.collect(req.http.x-forwarded-for);
if (req.http.x-forwarded-for) {
        std.log("ip:" + req.http.x-forwarded-for);
} else {
        std.log("ip:" + client.ip);
}

Neither of these are working in Varnish 4 however and the first code block is essentially what's been coded into varnish at this point from what I've read. I have also tried this to no-avail:

remove req.http.X-Forwarded-For;
set    req.http.X-Forwarded-For = client.ip;

This last item is what is still in the vcl. I have put the entire vcl on pastbin (http://pastebin.com/Q1nCprxL) with some irrelevant sections removed. The x-forwarded-for is there, varnish is simply logging the right-most IP address rather than the leftmost ip address.

X-Forwarded-For: 209.53.112.36, 172.25.10.228

dcmbrown dcmbrown · Accepted Answer · 2017-03-07T15:15:04

So it is likely these methods should all work. Which of them is the one that you actually use is up to you however. It turned out that the answer to my issue was not due to any discrepencies between 3 and 4 but rather the lack of a return(hash) at the end of vcl_recv() (and a possible bug with it erasing all except the last IP in X-Forwarded-For).

Varnish 4 logging proxy/load balancer instead of client IP addresses

1 Answers