Get host string from something other than 'global $base_url'

Looking to get the host string from something other than 'global $base_url'.

Use case: Our implementation currently runs two Drupal servers (drupal1.domain.com & drupal2.domain.com) behind a load balancer (lb.domain.com). Anonymous users (public webpages) are served through the load balancer and therefore has the URL lb.domain.com. This is the host string that needs to be used for Varnish commands.

Authenticated users need to go either directly to one of the two Drupal servers. But if $base_url is set to the load balancer, then authenticated users get redirected to go through load balancer which is not what we want. So we do NOT set the $base_url. As such, Varnish module is currently, by default, issuing commands to drupal1.domain.com or drupal2.domain.com instead of lb.domain.com