Cloudflare Tunnel 502: Fix Origin Connection Errors When the Tunnel Is Healthy

If a Cloudflare Tunnel is Healthy but the site returns 502, first check the connection from cloudflared to the origin service. In particular, a log saying “Unable to reach the origin service” indicates that the tunnel is connected to Cloudflare but cannot reach the local service. Check the port, protocol, network location, and HTTPS certificate in that order. Not every 502 has this cause, so inspect the exact message and logs.

An AI-generated conceptual illustration of cloud and origin connections; it is not a product screenshot or a network diagram.

Documentation checked: November 4, 2026. These commands and settings are illustrative examples based on official documentation; they were not run against a real tunnel. Replace example hosts and ports for your environment.

Healthy does not verify the origin service

Healthy describes the connection between cloudflared and Cloudflare; it does not establish that the route's local service is healthy. The 502 message described above points to the connection between cloudflared and the origin. Error 1033 calls for separate investigation of the tunnel connection or routing. An origin application can also return a 502 itself, so the status code alone cannot establish the cause. Tunnel troubleshooting

1. Test from where cloudflared runs

Record the route's Service URL and test that address from the same network environment as cloudflared. This example assumes the origin listens for HTTP on port 8080.

If there is no response, check that the process is running and listening on the expected address and port, and that firewalls or network paths permit the connection. An HTTP error response can still mean that the TCP connection succeeded; inspect the status and response separately. A connection refused log can indicate a stopped process or an incorrect port.

When cloudflared runs in a container, localhost generally refers to that container's own network namespace. Do not assume it is the host's localhost or another container's. Use an address reachable from cloudflared, such as a service name and port on a shared network, and test from its environment. If the service listens only on IPv4, also compare an [::1] address in the log with the actual bind address.

2. Match protocol and port

The route's Service URL is the origin address reachable by cloudflared, not the public URL visitors use. Configure http:// for an HTTP listener or https:// for an HTTPS listener, with the actual port. Do not use the public hostname as the origin URL if it points back to the tunnel. Troubleshoot HTTPS origins

Using HTTPS for an HTTP listener, or vice versa, can cause protocol errors even when a connection opens. If the origin redirects HTTP to HTTPS, check the HTTPS listener and certificate or adjust the origin redirect policy. Changing the Cloudflare zone SSL/TLS mode does not automatically change the Tunnel Service URL protocol.

3. Check the HTTPS certificate name and trust

Distinguish an x509 name mismatch from an untrusted certificate authority in the logs. For example, if cloudflared connects to localhost but the certificate covers app.example.com, a locally managed tunnel can specify the certificate name:

This illustrates the relevant ingress rule; it is not an instruction to replace your existing configuration. For a private CA, configure caPool so cloudflared trusts that CA. Fix the name and trust chain rather than turning off certificate verification. Validate locally managed ingress syntax with cloudflared tunnel ingress validate. For a dashboard-managed tunnel, inspect the equivalent TLS settings on the route. Certificate and configuration examples

Verify both sides after the change

Check whether the relevant error disappears from cloudflared logs, then request the origin URL again from the environment where cloudflared runs. Finally, request the public hostname from outside and inspect the status and redirects.

A successful response describes that path at that moment. It does not guarantee that other application paths or future requests will succeed. Logs and request output may contain hostnames, cookies, or credentials; remove them before sharing.

한국어 버전: Cloudflare Tunnel 502 오류: Healthy인데 원본 서비스에 연결되지 않을 때