Reverse Proxying

cafuego — Fri, 11 Feb 2011 03:58:44 +0000

After an unnamed vBulletin website fell over for the umpteenth time overnight, I suggested to its owner that we upgrade the Linux install that runs it to something vaguely recent. That would allow us to make use of the varnish cache to speed things up.

When using reverse proxying, your web server will see all requests as coming from the proxy host - 127.0.0.1 in my case - and that makes for useless logs. If a website keeps track of failed logins by IP address, it can even prevent all users from logging in after only a handful of problems, as all users are deemed to be on the same IP.

Enter mod_rpaf for Apache. That module re-plumbs the Apache internals so that if an X-Forwarded-For header is present in the HTTP request, it will replace the proxy IP with whatever is set in the X-Forwarded-For header.

That means log entries once again get the end user's IP address and the REMOTE_ADDR environment variable is no longer set to the proxy's IP. Lovely!

One slight problem though is that it would seem Varnish doesn't set the X-Forwarded-For header by default and that most Google hits for how to set it give incorrect instructions.

Here is what I used and have found to actually work with Apache 2.2 and Varnish 2.1 on Ubuntu 10.04 (Lucid).

sub vcl_recv {
  unset req.http.X-Forwarded-For;
  set req.http.X-Forwarded-For = regsub(client.ip, ":.*", "");
}

The only giant caveat that I can see would be that the regex call cannot cope with IPv6 addresses at all. Patches welcome :-)

Tags:

varnish

apache

proxy