In this case, having a server that runs a couple of websites with a varnish service configured as well.

Now, on another server I run 2 wp multisites in a LAMP environment + W3TC Cache + APC, and now I want to configure my first server to serve as reverse proxy for it.

and I wondering if this would do it:

acl whitelist {
        "ip server with varnish";
        "ip wordpress server";

sub vcl_recv {
    if ( ! client.ip ~ whitelist) {
       error 403 "Access denied";

Before starting testing, as I have very little experience with Varnish, I would like to hear your opinion about setting my server VCL's ACL to allow this request from external servers


Just to point it out, Apache responds to 8080 port and Varnish to 80.


DAEMON_OPTS="-a ip-server-1:80 \
             -T localhost:6082 \
             -f /etc/varnish/main.vcl \
             -S /etc/varnish/secret \
             -s file,/var/lib/varnish/$INSTANCE/varnish_storage.bin,1G"
  • So you'd like to keep Varnish as a front-end for the existing sites, while adding additional sites that Varnish will service from the other server? How will Varnish tell the difference between these requests - do they have different hostnames, for instance? – Shane Madden Apr 3 '13 at 5:38
  • Yes, they are different sites on different servers with different hostnames... and want to use one of the different servers, to act as reverse proxy for the other – w0rldart Apr 3 '13 at 9:47

What you added will make sure that nobody except the given hosts will be able to get a request through to the servers behind it.

Instead you can easily check the host requested and make varnish send the backend requests to the right server with something like this small example;

backend server1 {
        .host = "";
        .port = "81";

backend server2 {
        .host = "";
        .port = "80";

sub vcl_recv {

    if (req.http.host ~ "www.domain1.com") {
        set req.backend = server1;   

    if (req.http.host ~ "www.domain2.com") {
        set req.backend = server2;

| improve this answer | |
  • do I really have to do a req.http.host ~ "domain.tld"? Beacause that would mean that I would have to do an if for each and one of my sites that are going to use varnish. – w0rldart Apr 3 '13 at 23:18
  • in my default config, server1, apache listens 8080 and varnish 80... so therefor, captures all domains... can't I do something like that, base on the ip of the 2nd server? – w0rldart Apr 3 '13 at 23:18
  • You can capture the domains meant for the first server, then set all the rest to go to #2. Or if there's any sections in the domains that you can match (for instance all <subdomain>.domain2.com might go to server 2?). The request it is given is to it's own IP with just HTTP details (including HOST). That is what you need to use to direct it to the right backend. If you have an extra IP adress you might be able to run two instances on the same machine but I haven't tried it and with your setup I would much rather go for a 2nd varnish on the second server if you cant get across the hurdles. – Clarence Apr 4 '13 at 6:39
  • Ok, so I try applying your advice, but for some reasons... wordpress w3tc won't send anything to the varnish server. Will keep trying – w0rldart Apr 4 '13 at 10:56
  • You would put varnish infront of the web server and direct traffic FROM varnish TO the web server. Not the other way around. – Clarence Apr 4 '13 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.