Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have the following issue. I have a normal apache/varnish installation on a server with 5 IPs and varnish sends each request to apache using the local IP (which i think is normal since in the backend I can get the referrer with php's $_SERVER['HTTP_X_FORWARDED_FOR'].

I cannot use though the .htaccess file's blocks since apache gets only the local IP. Everything I deny from inside .htaccess is never applied. If i go to port :81 (apache's port), the block works normally.

What I need to do is find a way to either block the IP from varnish itself or send back to apache the original referrer ID and all this without restarting varnish (Of course, if this is not possible, I will have to do so...)

That specific IP I want to block, is getting very suspicious......

Thank you all in advance

share|improve this question

You should install mod_rpaf on your apache server. This will update the remote address with the last IP address from the X-Forwarded-For header. On debian based systems:

sudo apt-get install libapache2-mod-rpaf

then restart apache.

share|improve this answer
Thank you so much!!!! I'll try this in a non-production server first to experiment with it. It seems the appropriate solution but the site is unreachable at this moment. – pataroulis Jun 14 '11 at 13:14
Is there an alternate download site except It seems to be down completely – pataroulis Jun 16 '11 at 20:06
Have you checked your distribution repos to see if there is a precompiled binary available for your distribution? The latest file is mod_rpaf-0.6.tar.gz. I found a copy at… . – qbert220 Jun 17 '11 at 8:15

I would block it on the varnish side

It would scale better

share|improve this answer
Thanks!! Is there a way to avoid restarting varnish? – pataroulis Jun 14 '11 at 12:24
is the restart to avoid clearing the in-memory cache? – Mike Jun 14 '11 at 13:21
yes.. It has painstakingly grown to a point where it actually serves its purpose and I would hate to wait a couple of days of increased load to get all these stuff back into mem. (~1.4 million objects) – pataroulis Jun 14 '11 at 13:30
use varnishadm, and do vcl.load somealias /path/to/vcl, followed by vcl.use somealias – Kvisle Oct 27 '11 at 15:54

You can avoid restarting varnish by using the following method:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.