C

The Varnish VCL match operator (~) will currently only match an ACL (access control list) to an IP address data type. Since there's no way to cast a string to an IP in VCL (although it is planned), you can't match a forwarded-for header against an ACL without using inline C. You can only match client.ip, which can be a problem depending on the cluster configuration. The following hack works by using VCL's inline C functionality to do the cast. …