1

I have the following issue. I have a normal apache/varnish installation on a server with 5 IPs and varnish sends each request to apache using the local IP (which i think is normal since in the backend I can get the referrer with php's $_SERVER['HTTP_X_FORWARDED_FOR'].

I cannot use though the .htaccess file's blocks since apache gets only the local IP. Everything I deny from inside .htaccess is never applied. If i go to port :81 (apache's port), the block works normally.

What I need to do is find a way to either block the IP from varnish itself or send back to apache the original referrer ID and all this without restarting varnish (Of course, if this is not possible, I will have to do so...)

That specific IP I want to block, is getting very suspicious......

Thank you all in advance

3 Answers 3

2

You should install mod_rpaf on your apache server. This will update the remote address with the last IP address from the X-Forwarded-For header. On debian based systems:

sudo apt-get install libapache2-mod-rpaf

then restart apache.

3
  • Thank you so much!!!! I'll try this in a non-production server first to experiment with it. It seems the appropriate solution but the stderr.net site is unreachable at this moment.
    – pataroulis
    Jun 14, 2011 at 13:14
  • Is there an alternate download site except stderr.net? It seems to be down completely
    – pataroulis
    Jun 16, 2011 at 20:06
  • Have you checked your distribution repos to see if there is a precompiled binary available for your distribution? The latest file is mod_rpaf-0.6.tar.gz. I found a copy at sourceforge.net/projects/lnamp/files/soft/mod_rpaf-0.6.tar.gz/… .
    – qbert220
    Jun 17, 2011 at 8:15
1

You can avoid restarting varnish by using the following method: http://technosophos.com/2010/09/09/varnish-reloading-vcl-configuration-files-varnishadm.html (link updated thanks to alvherre)

2
0

I would block it on the varnish side

http://www.varnish-cache.org/lists/pipermail/varnish-misc/2011-February/005628.html

It would scale better

4
  • Thanks!! Is there a way to avoid restarting varnish?
    – pataroulis
    Jun 14, 2011 at 12:24
  • is the restart to avoid clearing the in-memory cache?
    – Mike
    Jun 14, 2011 at 13:21
  • yes.. It has painstakingly grown to a point where it actually serves its purpose and I would hate to wait a couple of days of increased load to get all these stuff back into mem. (~1.4 million objects)
    – pataroulis
    Jun 14, 2011 at 13:30
  • 1
    use varnishadm, and do vcl.load somealias /path/to/vcl, followed by vcl.use somealias
    – Kvisle
    Oct 27, 2011 at 15:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .