Here's a decent Chef workaround for Varnish's lack of support for ACL behind a proxy.

default.vcl.erb

sub vcl_recv {
    if (req.url ~ "(?i)^/admin" && req.http.x-forwarded-for !~ "\b(<%= @ips.map{ |ip| Regexp.escape(ip) }.join('|') %>)$") {
        error 750 "Moved Temporarily";
    }
}

sub vcl_error {
    if (obj.status == 750) {
        set obj.http.Location = "/";
        set obj.status = 302;
        return(deliver);
    }
}