IP & X-Forward-for

[Erik Torlen]

Hi,

Im experiencing a strange problem when using varnish in front of apache2.
I m running a php website where I log the client IP to the usertable in 
the database.

I first check the Client IP to see if it is a valid IP, if not, I check 
the "x-forward-for" for a valid ip (I check for multiple IPs in 
x-forward-for).
If neither client ip or x-forward-for contained a valid ip, it returns 
the client ip (in most cases 127.0.0.1).

The strange thing is that I get alot of IPs that comes from 127.0.0.1 
which means that x-forward-for is NOT set.

This is the log from varnish:
81.224.31.xxx - - [31/Jan/2008:20:52:09 +0100] "GET
127.0.0.1 - - [31/Jan/2008:20:52:09 +0100] "(null) (null) (null)" (null) 
(null) "-" "-"
backendserver - - [31/Jan/2008:19:52:09 +0100] "GET
81.227.81.xxx - - [31/Jan/2008:20:52:09 +0100] "GET
127.0.0.1 - - [31/Jan/2008:19:52:11 +0100] "GET
217.197.62.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
127.0.0.1 - - [31/Jan/2008:19:52:11 +0100] "GET
85.229.6.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
127.0.0.1 - - [31/Jan/2008:19:52:11 +0100] "GET
85.229.6.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
127.0.0.1 - - [31/Jan/2008:19:52:12 +0100] "GET
83.233.193.xxx - - [31/Jan/2008:20:52:12 +0100] "GET

Why does it have so many connections from 127.0.0.1 and why is the date 
an hour late?
It also got a "connection" from "backendserver" which is the name of my 
backendserver in the vcl config.

The logfile from apache2 shows me this whit the same connections:
81.224.31.xxx - - [31/Jan/2008:20:52:08 +0100] "GET
81.227.81.xxx - - [31/Jan/2008:20:52:09 +0100] "GET
217.197.62.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
85.229.6.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
85.229.6.xxx - - [31/Jan/2008:20:52:11 +0100] "GET
83.233.193.xxx - - [31/Jan/2008:20:52:12 +0100] "GET

No 127.0.0.1 connections in this logfile. Is the 127.0.0.1 connections 
from apache2 when varnish fetches the object from back their?

Im not sure if these logentries say enough about my problem. I will try 
to find some more entries that could show some more about the issue.

I appreciate all help I can get on this one.

/ Erik