I'm using Varnish ACLs for blocking unwanted clients by IP and as the blocklist/ACL has grown the compile time of the VCL has increased a lot. The other day I added another 25K IPs to block and Varnish no longer loads the VCL but instead responds with:
"Command failed with error code 400" "CLI communication error (hdr)".
Does anyone know of a way of using Varnish to block lots of IP addresses?
I don't want to use iptables as I want to respond with a 403 error
page.
The blocklist ACLs right now contains about 190K entries, most of which are single IPs (i.e. /32, not ranges).
/usr/bin/varnishadm -S /etc/varnish/secret -T localhost:6081 vcl.load file_default.vcl_time_1542634958 /etc/varnish/default.vcl
Command failed with error code 400
CLI communication error (hdr)
real 33m20.101s
user 0m0.004s
sys 0m0.000s
The code and the compile step seem to work as compile without load does not throw an error.
/usr/sbin/varnishd -C -f /etc/varnish/default.vcl
real 34m50.554s
user 34m33.124s
sys 0m15.332s
ipset
/iptables
to redirect web request from your unwanted clients to that different port.ipset
withhash:ip
will probably scale better than managing such a large ACL in varnish. – HBruijn Nov 19 '18 at 15:43