The way I've handled it in the past in Varnish is just to look for the upgrade request and do basically: "Whao they wanna do websockets? I give up, return(pipe);" which means Varnish will from then on just ferry bytes from one sock to the other.