Varnish or other reverseproxy hides IP

In the security report, all intrusion attempts are listed as coming from my Varnish installation, as that’s the last IP hop in my internal network before reaching WordPress.

Would it be possible to honor the X-Forwarded-For HTTP header (note that the header may carry several comma-separated IPs) in the report? I am aware that this header may be forged (and therefore my Varnish strips any such header previously put into the request) but having my Varnish node listed as attacker doesn’t really help me except to establish the total quantity of attacks.

Cheers,
Rick