<div dir="ltr">Yeah, I'm looking into PROXY. We have up to two proxies in the way, the first that all traffic has to go through is a Cisco Ace we use for load balancing and SSL offloading, and the second is a CaddyServer that some traffic will go through for LetsEncrypt certificates. It's getting both of those setup to present similar data to the Varnish nodes that's the trick - we don't have direct control of the Cisco gear either. Both should be able to do it, I guess I just need to work out the wrinkles.<div><br></div><div>--</div><div>Mark</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 31 March 2017 at 10:59, Guillaume Quintard <span dir="ltr"><<a href="mailto:guillaume@varnish-software.com" target="_blank">guillaume@varnish-software.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Mark, you need to use std.ip() from the std vmod.<div><br></div><div>Also, I highly recommend using the PROXY protocol (Varnish, HAProxy and Nginx, at least support it), it will allow you to use client.ip directly and not bother with this.</div></div><div class="gmail_extra"><br clear="all"><div><div class="m_-6214645900569540042gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div>-- <br></div>Guillaume Quintard<br></div></div></div>
<br><div class="gmail_quote"><div><div class="h5">On Fri, Mar 31, 2017 at 11:44 AM, Mark Hanford <span dir="ltr"><<a href="mailto:mark@hanfordonline.co.uk" target="_blank">mark@hanfordonline.co.uk</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hi folks.<div><br></div><div>Because my varnish nodes are behind two different proxies, I can't really use client.ip within my VCL. What I have is a header "X-Real-Ip" instead, which is populated automatically by one proxy, and by me derived from the "X-Forwarded-For" for the other.</div><div><br></div><div>What this means is that where I would usually use ACL to block access to a resource:</div><div><br></div><div> if (req.http.host == "<a href="http://test.mydomain.com" target="_blank">test.mydomain.com</a>") {</div><div> if (client.ip ~ trustedips) {</div><div> # allow access</div><div> } else {</div><div> return (synth(405, "Not allowed");<br></div><div> }</div><div> }</div><div><br></div><div>But this doesn't work if I replace client.ip with a non-IP typed field.</div><div><br></div><div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>Message from VCC-compiler:</div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>Expected CSTR got 'purgers'</div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>(program line 1193), at</div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>('default.vcl' Line 339 Pos 34)</div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>if (req.http.X-Real-Ip ~ trustedips) {</div><div><span class="m_-6214645900569540042m_-335127491946880979gmail-Apple-tab-span" style="white-space:pre-wrap"> </span>------------------------------<wbr>---##########---</div></div><div><br></div><div>Is there any way I can get the same result as this but without using client.ip?</div><div><br></div><div>thanks,</div><div><br></div><div>Mark</div></div>
<br></div></div>______________________________<wbr>_________________<br>
varnish-misc mailing list<br>
<a href="mailto:varnish-misc@varnish-cache.org" target="_blank">varnish-misc@varnish-cache.org</a><br>
<a href="https://www.varnish-cache.org/lists/mailman/listinfo/varnish-misc" rel="noreferrer" target="_blank">https://www.varnish-cache.org/<wbr>lists/mailman/listinfo/varnish<wbr>-misc</a><br></blockquote></div><br></div>
</blockquote></div><br></div>