Source: http://varnish.projects.linpro.no/changeset/1121 It appears it's missing a condition where varnish need to rewrite/append to the x-forwarded-for header if it already exists in the incoming http request instead of outputting a new/duplicate header. This can happen when varnish is behind HTTP based load balancer or proxy. Xing