{"record":{"id":"14f47c040801b44f","repo":"cloudflare/cloudflared","slug":"unable-to-reach-the-origin-service-the-service-ma","errorCode":null,"errorMessage":"Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared","messagePattern":"Unable to reach the origin service\\. The service may be down or it may not be responding to traffic from cloudflared","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"proxy/proxy.go","lineNumber":226,"sourceCode":"\t\t\t}\n\t\t}\n\t\t// Request origin to keep connection alive to improve performance\n\t\troundTripReq.Header.Set(\"Connection\", \"keep-alive\")\n\t}\n\n\t// Set the User-Agent as an empty string if not provided to avoid inserting golang default UA\n\tif roundTripReq.Header.Get(\"User-Agent\") == \"\" {\n\t\troundTripReq.Header.Set(\"User-Agent\", \"\")\n\t}\n\n\t_, ttfbSpan := tr.Tracer().Start(tr.Context(), \"ttfb_origin\")\n\tresp, err := httpService.RoundTrip(roundTripReq)\n\tif err != nil {\n\t\ttracing.EndWithErrorStatus(ttfbSpan, err)\n\t\tif err := roundTripReq.Context().Err(); err != nil {\n\t\t\treturn errors.Wrap(err, \"Incoming request ended abruptly\")\n\t\t}\n\t\treturn errors.Wrap(err, \"Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared\")\n\t}\n\n\ttracing.EndWithStatusCode(ttfbSpan, resp.StatusCode)\n\tdefer func() { _ = resp.Body.Close() }()\n\n\theaders := make(http.Header, len(resp.Header))\n\t// copy headers\n\tfor k, v := range resp.Header {\n\t\theaders[k] = v\n\t}\n\n\t// Add spans to response header (if available)\n\ttr.AddSpans(headers)\n\n\terr = w.WriteRespHeaders(resp.StatusCode, headers)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"Error writing response header\")\n\t}","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/proxy/proxy.go#L208-L244","documentation":"proxyHTTPRequest in proxy/proxy.go wraps any error returned by the origin HTTP transport's RoundTrip with this message. It means cloudflared could not get any HTTP response at all from the local origin service — the connection failed before a response arrived. Note the wrapper first checks the request context: if the incoming request was cancelled by the client, the error is rewrapped as 'Incoming request ended abruptly' instead.","triggerScenarios":"httpService.RoundTrip(roundTripReq) returns a non-nil error (dial failure, TLS failure, timeout, connection reset) while serving a request proxied through ProxyHTTP, and the request context is still alive.","commonSituations":"Origin web server is not running or listening on a different port than the tunnel config's service URL (e.g. http://localhost:8080 but app listens on 3000); origin crashed mid-deployment; firewall or SELinux blocking loopback; origin refusing plain HTTP where HTTPS is required (scheme mismatch).","solutions":["Verify the origin service is running: curl the configured service URL directly from the machine running cloudflared (e.g. curl -v http://localhost:8080).","Check the ingress/service URL in the tunnel config matches the actual origin port and scheme (http vs https).","Inspect the wrapped cause (errors.Wrap preserves the original error) — connection refused vs timeout vs TLS error points to different fixes.","If the origin uses HTTPS with a self-signed cert, configure originRequest settings (noTLSVerify / caPool) rather than switching to http.","Check firewall/SELinux rules blocking cloudflared's loopback connections to the origin."],"exampleFix":"// config.yaml before\ningress:\n  - service: http://localhost:8080\n// after (origin actually listens on 3000)\ningress:\n  - service: http://localhost:3000","handlingStrategy":"validation","validationCode":"// before serving traffic, verify the origin responds\nresp, err := http.Get(\"http://localhost:8080/healthz\")\nif err != nil {\n    log.Fatalf(\"origin service unreachable: %v\", err)\n}\nresp.Body.Close()","typeGuard":null,"tryCatchPattern":"if errors.Is(err, context.Canceled) || req.Context().Err() != nil {\n    // client cancelled; treat as 'Incoming request ended abruptly'\n    return\n}\n// otherwise inspect wrapped cause: connection refused vs timeout vs TLS\nvar netErr net.Error\nif errors.As(err, &netErr) && netErr.Timeout() {\n    // retry with backoff\n}","preventionTips":["Always health-check the origin URL before pointing an ingress rule at it.","Keep the tunnel config's service URL port and scheme in sync with the app (use config validation in CI).","Monitor origin process liveness (systemd/supervisor restart policies).","Add originRequest connectTimeout tuning for slow-starting origins."],"tags":["network","proxy","origin-service","cloudflared"],"backgroundTag":"connection-refused","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}