Fixing error 403 with Varnish cache

I've been running varnish (3.0.1) in front of Apache and during a spike in traffic two days ago all visitors to the site started to receive a 403 error. From Googling about I've found one thread which says this is caused by Varnish's IP being passed to Apache instead of the user's who's making the request. (see https://www.varnish-cache.org/lists/pipermail/varnish-misc/2011-March/005730.html)

The suggestion was "You could try passing the ip as x-forwarded-for"... I'm not sure what IP is being referred to (the client's?) or in fact how I'd go about doing that. Has anyone seen this before or knows how to achieve what is being suggested?

-

It is likely that your backend is only returning 403 once, but then Varnish is caching it for future requests. Yes, Varnish will cache even things you don't want it to cache such as error pages if you don't configure the VCL to do otherwise.

I can't really comment on whether your back end is rate limiting or not, but you should probably try to figure that out first before you start messing with Varnish headers to provide a solution for a problem you haven't figured out yet.

req.http.x-forwarded-for = client.ip