1

I'm using varnish to speed up my website, but I've noticed because it is technically a reverse proxy, all IP's show as 127.0.0.1 - I've fixed this by using HTTP_X_FORWARDED_FOR, but that's only fixing php programs, such as my forums. I've read through similar questions here where people are having issues trying to do "deny from" in htaccess, and it's not working due to varnish.

Many solutions after my research show that blocking IP's at the varnish level is the way to go, and unfortunately that's not working either. I've tried apache's mod_rpaf to attempt blocking IP's at the htaccess level, but that didn't do anything either.

Here is my varnish code in an attempt to block an example IP:

sub vcl_recv {
       if (client.ip ~ blacklist) {
           return (synth(403));
       }
}

And now the acl blacklist

acl blacklist {
"1.1.1.1";
}

With this setup, 1.1.1.1 is still able to access the website, and is not brought to my 403 page. To clarify, I'm using varnish 4, so the "error 403" is not compatible anymore, so you need to use return.

Is there anything I'm doing wrong? Has anybody else been in the same situation where they need to block IP's at the varnish level? Any suggestions?

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
0

For reference, here is the ACL documentation for Varnish 4.0.

This shouldn't matter, but have you tried explicitly stating the netmask?

acl blacklist {
    "1.1.1.1"/32;
}

Is Varnish at the front-most layer of your stack? If you look at the requests with varnishlog, are the IPs you see what you expect?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .