0

I'm using Varnish ACLs for blocking unwanted clients by IP and as the blocklist/ACL has grown the compile time of the VCL has increased a lot. The other day I added another 25K IPs to block and Varnish no longer loads the VCL but instead responds with:

"Command failed with error code 400" "CLI communication error (hdr)".

Does anyone know of a way of using Varnish to block lots of IP addresses?

I don't want to use iptables as I want to respond with a 403 error page.

The blocklist ACLs right now contains about 190K entries, most of which are single IPs (i.e. /32, not ranges).

/usr/bin/varnishadm -S /etc/varnish/secret -T localhost:6081 vcl.load file_default.vcl_time_1542634958 /etc/varnish/default.vcl
Command failed with error code 400
CLI communication error (hdr)

real    33m20.101s
user    0m0.004s
sys 0m0.000s

The code and the compile step seem to work as compile without load does not throw an error.

/usr/sbin/varnishd -C -f /etc/varnish/default.vcl

real    34m50.554s
user    34m33.124s
sys 0m15.332s
Improve this question
3
  • Why not use a firewall (e.g. iptables)? – Craig Watson Nov 19 '18 at 15:19
  • @CraigWatson I do not want to use iptables as I want to respond with a 403 error page – Paso Nov 19 '18 at 15:24
  • I would recommend that you run an additional webservice on different port that will only display your user-friendly error message and nothing else. Then use ipset / iptables to redirect web request from your unwanted clients to that different port. ipset with hash:ip will probably scale better than managing such a large ACL in varnish. – HBruijn Nov 19 '18 at 15:43
0

Increasing cli_buffer (size of buffer for CLI command input; default 8KB) and/or cli_limit (maximum size of CLI response; default 128KB) parameters will probably fix that issue.

Improve this answer
2
  • I don't see why that would help. The only thing that has changed is one ACL in the VCL and the full VCL is about 10Mb. Why would it be limited by the cli limits? – Paso Nov 20 '18 at 21:29
  • My suggestion is based on past experiences with large VCLs (not because of large ACLs, but because of large synthetic contents) and varnishadm + vcl.inline / vcl.show. Symptoms are identical to the ones described in your question, but I assume you have increased the suggested parameters and it didn't work for you. Sorry! – Carlos Abalde Nov 21 '18 at 17:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.