You may also modify vcl_recv to strip the __cfduid cookies set by Cloudflare so Varnish can cache the response. The following VCL will strip all cookies starting with two underscores or including 'has_js', such as Cloudflare and Google Analytics cookies:

    sub vcl_recv {
      # Remove has_js and Cloudflare/Google Analytics __* cookies.
      set req.http.Cookie = regsuball(req.http.Cookie, "(^|;\s*)(_[_a-z]+|has_js)=[^;]*", "");
      # Remove a ";" prefix, if present.
      set req.http.Cookie = regsub(req.http.Cookie, "^;\s*", "");
    }



Also see: Cloudflare and Varnish