Parse XFF and check it against an ACL

xff_acl.vcl

vcl 4.0;

import std;

backend default
{
  .host = "127.0.0.1";
  .port = "80";
}

acl security
{
  "65.0.0.0"/8;
  "80.81.0.0"/16;
  "192.168.1.0"/24;
  ! "192.168.1.23";
}

sub vcl_recv
{
  # Grab the first XFF ip, Varnish will append current client.ip
  set req.http.X-client-ip = regsub(req.http.X-Forwarded-For, ",.*$", "");

  # ACL security check
  if (std.ip(req.http.X-client-ip, "0.0.0.0") ~ security) {
    std.log("Security ACL passed");
  } else {
    std.log("Security ACL failed");
  }
}