I have the following issue. I have a normal apache/varnish installation on a server with 5 IPs and varnish sends each request to apache using the local IP (which i think is normal since in the backend I can get the referrer with php's $_SERVER['HTTP_X_FORWARDED_FOR'].

I cannot use though the .htaccess file's blocks since apache gets only the local IP. Everything I deny from inside .htaccess is never applied. If i go to port :81 (apache's port), the block works normally.

What I need to do is find a way to either block the IP from varnish itself or send back to apache the original referrer ID and all this without restarting varnish (Of course, if this is not possible, I will have to do so...)

That specific IP I want to block, is getting very suspicious......

Thank you all in advance


You should install mod_rpaf on your apache server. This will update the remote address with the last IP address from the X-Forwarded-For header. On debian based systems:

sudo apt-get install libapache2-mod-rpaf

then restart apache.

  • Thank you so much!!!! I'll try this in a non-production server first to experiment with it. It seems the appropriate solution but the stderr.net site is unreachable at this moment. – pataroulis Jun 14 '11 at 13:14
  • Is there an alternate download site except stderr.net? It seems to be down completely – pataroulis Jun 16 '11 at 20:06
  • Have you checked your distribution repos to see if there is a precompiled binary available for your distribution? The latest file is mod_rpaf-0.6.tar.gz. I found a copy at sourceforge.net/projects/lnamp/files/soft/mod_rpaf-0.6.tar.gz/… . – qbert220 Jun 17 '11 at 8:15

I would block it on the varnish side


It would scale better

  • Thanks!! Is there a way to avoid restarting varnish? – pataroulis Jun 14 '11 at 12:24
  • is the restart to avoid clearing the in-memory cache? – Mike Jun 14 '11 at 13:21
  • yes.. It has painstakingly grown to a point where it actually serves its purpose and I would hate to wait a couple of days of increased load to get all these stuff back into mem. (~1.4 million objects) – pataroulis Jun 14 '11 at 13:30
  • 1
    use varnishadm, and do vcl.load somealias /path/to/vcl, followed by vcl.use somealias – Kvisle Oct 27 '11 at 15:54

You can avoid restarting varnish by using the following method: http://technosophos.com/content/varnish-reloading-vcl-configuration-files-varnishadm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.