Good Morning,

> You can see the right X-Forwarded-For header with tcpdump.
>
> Take a look at the log format varnish uses. I don't know how to
> configure varnish, but with Apache you have to change your LogFormat
> from
>
> LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"
> \"%{User-Agent}i\"" combined
>
> to something like
>
> LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b
> \"%{Referer}i\"\"%{User-Agent}i\"" nginx

Good idea. I'll check if varnish is able to do that.

thx
revirii