It ends up that ns_write breaks certain reverse proxies (i.e. pound). This is because it never sends an http header.
I switched to squid, which seems like a lot of overhead for what I need. I also tried nxunix/vhr under 3.5 and have it working except that the log files show the original ip.
If anyone has a fix for the x-forwarded-for header of ns_log I would really appreciate it.
I am documenting my trials and tribulations with single ip/multiple servers for an advanced config guide.
