Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsSlow PC?RecommendedPC slow today? Run a repair scan before it gets worseResolve common Windows issues and optimize system performance.Scan Now×
Skip to content
World desk9 min

How to Install and Configure Varnish With Apache

A practical Debian, Ubuntu, and RHEL-compatible guide to placing Varnish in front of Apache, changing ports safely, configuring the backend, and troubleshooting 503 responses.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Install Varnish as the public-facing HTTP cache and keep Apache as the origin server behind it. On a single Debian or Ubuntu host, the dependable layout is Varnish listening on port 80, Apache listening on port 8080, and /etc/varnish/default.vcl pointing to 127.0.0.1:8080. You must change Apache’s Listen directive and every enabled virtual host binding, then reload systemd if you changed the Varnish service definition.

This arrangement lets you test each layer independently: Apache directly on port 8080, then Varnish publicly on port 80. That separation is the key to diagnosing the common 503 error after moving Apache.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How the Apache–Varnish layout works

Varnish is the front-end HTTP cache. Apache remains the backend, also called the origin server: it generates responses that Varnish can store and serve to later clients. Varnish’s documentation describes this relationship in terms of a “backend” or “origin” server.

On one machine, both daemons cannot bind the same IP address and TCP port. Move Apache to an alternate HTTP port, normally 8080, and reserve port 80 for Varnish. Varnish’s quick-start guidance identifies 8080 as a suitable alternative HTTP port for the web server.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Component Typical address Role
Varnish :80 Receives client HTTP requests, serves cached objects, and forwards misses to Apache.
Apache 127.0.0.1:8080 Origin server that renders dynamic pages and supplies uncached responses.
VCL backend .host = "127.0.0.1", .port = "8080" Defines where Varnish connects when it needs an origin response.

If Apache is on another host, Varnish can stay on port 80 locally and the VCL backend can use that origin host’s address and port. The port numbers are not magic; they must match the listeners that are actually running.

Before you change ports

Confirm the operating system and package source

The detailed commands below target Debian and Ubuntu, where Apache is managed as apache2 and configuration is normally under /etc/apache2. RHEL-compatible systems use the httpd service and configuration under /etc/httpd; an equivalent procedure appears later.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Make sure Apache works by itself

Before introducing a cache, request the site directly from Apache on its current port and confirm that the expected virtual host, application, logs, and permissions work. If the origin is already broken, adding Varnish makes the symptoms harder to interpret.

Inventory all Apache bindings

Do not edit only the first site you see. List the enabled sites and included configuration files, then search for every Listen 80 and every <VirtualHost *:80> (or an equivalent address-specific binding). A single remaining port-80 directive can prevent Varnish from starting or leave one site bypassing the intended layout.

Install Varnish on Debian or Ubuntu

1. Refresh package metadata and install the package

sudo apt-get update
sudo apt-get install varnish

The package supplies the daemon, a systemd service, and the standard VCL location. Do not assume the package’s default listener is already the final configuration; inspect the installed unit before changing it.

2. Move Apache’s main listener to port 8080

Open /etc/apache2/ports.conf and change the HTTP listener:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Listen 8080

Keep any separate HTTPS listener unchanged if TLS is still handled by Apache. This article’s basic topology concerns HTTP on port 80; HTTPS needs its own certificate and termination design.

Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.

3. Change every enabled virtual host binding

For each enabled Apache site, replace the port-80 binding with port 8080:

<VirtualHost *:8080>
    ServerName example.test
    # existing directives
</VirtualHost>

Apply the change in every file that is actually included, including sites enabled through Apache’s site-management commands and any administrator-created include. Keep the ServerName, aliases, document roots, proxy rules, and logging directives intact.

Validate the Apache configuration before restarting:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
sudo apache2ctl configtest

A successful syntax check does not prove that all sites are reachable, but it catches malformed edits and duplicate or invalid directives.

4. Restart Apache and test the origin directly

sudo systemctl restart apache2
curl -I http://127.0.0.1:8080/

If name-based virtual hosting is used, send the intended hostname in the request so Apache selects the correct site:

curl -I -H 'Host: www.example.test' http://127.0.0.1:8080/

Resolve any failure here before configuring Varnish. The origin must answer on the exact address and port that will appear in the VCL.

5. Define Apache as the Varnish backend

Edit /etc/varnish/default.vcl and use VCL 4.1 with the actual Apache endpoint:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
vcl 4.1;

backend default {
    .host = "127.0.0.1";
    .port = "8080";
}

A backend must specify either a .host or a .path attribute, not both. For a TCP connection to Apache, use .host and .port as shown. If Apache binds to a different local address, use that address instead of 127.0.0.1.

6. Configure Varnish to listen on port 80

Inspect the package unit and any distribution-specific defaults:

systemctl cat varnish

Change the daemon arguments so the listener is -a :80 and the loaded VCL file is -f /etc/varnish/default.vcl. Use the package’s supported configuration mechanism: either edit the unit where the distribution expects local changes or create a systemd drop-in with sudo systemctl edit varnish. Preserve the other arguments supplied by the distribution, such as storage, privilege, or runtime options. Do not replace the complete command with a shortened example that silently drops required settings.

When a drop-in overrides an existing ExecStart, systemd generally requires clearing the old command before defining the complete replacement. Copy the installed command from systemctl cat varnish, alter only the listener and VCL path, and retain the remaining options exactly as appropriate for that package.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

7. Reload systemd and restart Varnish

sudo systemctl daemon-reload
sudo systemctl restart varnish

daemon-reload is required after changing a unit file or drop-in. Without it, systemd can continue using the previous service definition even though the file on disk has changed.

8. Check both services and the sockets

sudo systemctl status varnish apache2
sudo ss -ltnp

Look for Varnish bound to port 80 and Apache bound to port 8080. Then request the public listener:

curl -I http://127.0.0.1/

Use an appropriate Host header when several virtual hosts share the listener. These commands are operational checks; they do not imply a particular cache-hit ratio or latency result.

Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

What belongs in default.vcl

The minimal backend declaration

The backend block is the connection map between Varnish and Apache. The hostname or address is resolved when the VCL is compiled. With a numeric loopback address, the endpoint is stable unless the local binding changes. With a hostname, Varnish uses the address available at compilation time.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Hostname backends and DNS changes

A hostname can be useful when the origin is on another server or when an address is managed through DNS. However, changing the DNS record alone does not make a running Varnish process discover the new address. Reload or restart the VCL after the DNS change so Varnish recompiles the backend and resolves the hostname again.

One backend versus several

A single backend default is sufficient for one Apache origin. Multiple backends can support failover or load balancing, but they require explicit routing and health-check decisions. Decide which backend handles a request, how an unhealthy origin is detected, and what happens to existing cached objects before adding that complexity.

Deployment choices and their trade-offs

Decision Option A Option B What changes operationally
Origin placement Same host: Varnish on 80, Apache on 8080. Separate origin host: Varnish on 80, remote Apache address in VCL. Same-host deployments avoid a network hop but require coordinated local port changes. Remote origins add network reachability and firewall considerations.
HTTP and TLS HTTP-only Varnish listener. TLS terminated by another proxy, with Varnish receiving the resulting HTTP traffic. Varnish’s listener, headers, and trust boundaries must match the component that terminates TLS. Do not expose an unencrypted origin unintentionally.
Backend count One Apache backend. Clustered or failover backends. Several origins need routing rules, health checks, and a policy for failures and cache consistency.
Service management Edit the package-managed unit where supported. Use a local systemd override. Overrides are easier to preserve across package upgrades, but the complete effective ExecStart must still include required distribution arguments.
Backend address Numeric address such as 127.0.0.1. Hostname. Numeric addresses avoid DNS re-resolution issues. Hostnames are convenient but require a VCL reload after an address change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

RHEL-compatible installation

On RHEL-compatible distributions, follow the Varnish Cache repository and package workflow supported for that distribution. The service is normally named varnish, while Apache is managed as httpd.

  1. Install Varnish using the distribution’s supported repository and package method.
  2. Confirm Apache serves the application directly before introducing the cache.
  3. Change Apache’s HTTP listener under /etc/httpd from port 80 to 8080, using the distribution’s included configuration files.
  4. Change every enabled Apache virtual host binding to port 8080, not just the first file.
  5. Set the VCL backend to the real Apache address and port, commonly 127.0.0.1:8080.
  6. Configure Varnish’s listener for port 80 and retain the package’s required daemon arguments.
  7. Run sudo systemctl daemon-reload after unit or drop-in edits, then restart Varnish.
  8. Check systemctl status varnish httpd, inspect listeners with ss -ltnp, test Apache directly on 8080, and finally test Varnish on 80.

File names and include layouts differ between releases, so use the active httpd configuration and the effective Varnish unit on the target machine rather than copying a Debian path verbatim.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Diagnose a 503 response

A Varnish 503 in this setup usually means Varnish could not connect to the configured backend. Work from the origin outward so each layer is isolated.

1. Test Apache on its new port

curl -I http://127.0.0.1:8080/
# or, for a named virtual host:
curl -I -H 'Host: www.example.test' http://127.0.0.1:8080/

If this fails, inspect Apache’s status and error log, confirm the configuration test, and verify that the process is listening on the address and port you placed in VCL.

2. Compare the VCL endpoint with the actual listener

Check that .host and .port in /etc/varnish/default.vcl exactly match Apache. Common mistakes include leaving .port = "80", using an address Apache does not bind, or changing Apache to 8080 while leaving one virtual host or include on port 80.

3. Check whether Apache still owns port 80

sudo ss -ltnp

If Apache is still bound to port 80, Varnish cannot bind there. Search all Apache Listen and VirtualHost directives, including included and enabled files, then restart Apache after correcting them.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

4. Confirm systemd loaded the new unit

If changing the listener appears to have no effect, run:

sudo systemctl daemon-reload
sudo systemctl restart varnish
systemctl cat varnish

The last command shows the merged unit and drop-ins that systemd is using. Check that the effective command contains port 80 and the intended VCL path.

5. Reload after DNS changes

When the backend is a hostname whose DNS address changed, reload or restart Varnish so the VCL is compiled again. Merely waiting for DNS propagation does not update an already compiled backend definition.

6. Test the public layer last

curl -I http://127.0.0.1/

If Apache succeeds on 8080 but this request fails, focus on Varnish startup, its listener, VCL compilation, and connectivity from Varnish to the backend. If both requests succeed but the wrong site appears, send the expected Host header and review Apache’s name-based virtual-host order.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Operational checks after the first successful request

  • Keep a repeatable direct-origin command for port 8080 and a public-listener command for port 80. They provide a fast way to identify which layer changed after an upgrade or configuration edit.
  • Record the effective Varnish unit with systemctl cat varnish so future package updates do not overwrite an undocumented listener or VCL choice.
  • After editing VCL, restart or otherwise reload Varnish through the service mechanism and check its status before testing traffic.
  • When adding another backend, define routing and health behavior deliberately instead of assuming Varnish will fail over automatically.
  • When a proxy terminates TLS in front of Varnish, document which headers identify the original scheme and client, and ensure the origin receives the headers your application expects.

Configuration checklist

  • Varnish package is installed and its service uses /etc/varnish/default.vcl.
  • Varnish listens on port 80.
  • Apache listens on port 8080 on the address named in VCL.
  • Every enabled Apache virtual host uses port 8080.
  • sudo apache2ctl configtest (or the equivalent httpd validation) succeeds.
  • Apache responds directly on 8080 before Varnish is tested.
  • sudo systemctl daemon-reload has been run after unit or drop-in changes.
  • Varnish and Apache both report active status.
  • ss -ltnp shows the intended ownership of ports 80 and 8080.
  • A request through port 80 reaches the expected virtual host.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
PC Slower Than It Used to Be?Free scan - under a minute
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.