Varnish purging showing error 403 Not allowed

It is likely that your backend is only returning 403 once, but then Varnish is caching it for future requests. Yes, Varnish will cache even things you don't want it to cache such as error pages if you don't configure the VCL to do otherwise.

I can't really comment on whether your back end is rate limiting or not, but you should probably try to figure that out first before you start messing with Varnish headers to provide a solution for a problem you haven't figured out yet.

However, to answer your question, you can set the x-forwarded-for header in Varnish like so:

in vlc_recv

req.http.x-forwarded-for = client.ip

Assuming Varnish3

if (req.request == "PURGE") {
 if (!client.ip ~ purge) {
   error 405 "Not allowed.";
 }
 return(lookup);
}

This block is incorrect, it will trigger a 405 error when a client not allowed to purge attempts to do so, but there is nothing in there to actually purge if a valid client attempts to do so, instead it will return content from cache.

        if (req.request == "PURGE") {
                if (!client.ip ~ purge) {
                        error 405 "Not allowed.";
                }
                ban("req.url ~ "+req.url);
                error 200 "Purged";
        }

This block should do what you need it to do.