ACL X-Forwarded-For "2nd-to-last" also works with IPv6 addresses.

pkg/varnish/vcl/testdata/acl.golden

@@ -51,7 +51,7 @@ sub vcl_recv {
 		return(synth(403));
 	}
 	if (
-	    std.ip(regsub(req.http.X-Forwarded-For,"^.*?([\d.]+)\s*,[^,]*$","\1"), "0.0.0.0") !~ vk8s_local_acl
+	    std.ip(regsub(req.http.X-Forwarded-For,"^.*?([[:xdigit:]:.]+)\s*,[^,]*$","\1"), "0.0.0.0") !~ vk8s_local_acl
 	   ) {
 		return(synth(403));
 	}

pkg/varnish/vcl/vcl.go

@@ -533,7 +533,7 @@ func aclMask(bits uint8) string {
 
 const (
 	xffFirst   = `regsub(req.http.X-Forwarded-For,"^([^,\s]+).*","\1")`
-	xff2ndLast = `regsub(req.http.X-Forwarded-For,"^.*?([\d.]+)\s*,[^,]*$","\1")`
+	xff2ndLast = `regsub(req.http.X-Forwarded-For,"^.*?([[:xdigit:]:.]+)\s*,[^,]*$","\1")`
 )
 
 func aclCmp(comparand string) string {