I'm using Varnish ACLs for blocking unwanted clients by IP and as the blocklist/ACL has grown the compile time of the VCL has increased a lot. The other day I added another 25K IPs to block and Varnish no longer loads the VCL but instead responds with:
"Command failed with error code 400" "CLI communication error (hdr)".
Does anyone know of a way of using Varnish to block lots of IP addresses?
I don't want to use iptables as I want to respond with a
403 error page.
The blocklist ACLs right now contains about 190K entries, most of which are single IPs (i.e. /32, not ranges).
/usr/bin/varnishadm -S /etc/varnish/secret -T localhost:6081 vcl.load file_default.vcl_time_1542634958 /etc/varnish/default.vcl Command failed with error code 400 CLI communication error (hdr) real 33m20.101s user 0m0.004s sys 0m0.000s
The code and the compile step seem to work as compile without load does not throw an error.
/usr/sbin/varnishd -C -f /etc/varnish/default.vcl real 34m50.554s user 34m33.124s sys 0m15.332s