{"record":{"id":"4a3d04f44482e6aa","repo":"cloudflare/cloudflared","slug":"connect-to-v-failed-v","errorCode":null,"errorMessage":"Connect to %v failed: %v","messagePattern":"Connect to (.+?) failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"socks/request_handler.go","lineNumber":84,"sourceCode":"\t\t\t\treturn fmt.Errorf(\"Connect to %v denied due to iprule: %s\", req.DestAddr, rule.String())\n\t\t\t}\n\t\t\treturn fmt.Errorf(\"Connect to %v denied\", req.DestAddr)\n\t\t}\n\t}\n\n\ttarget, localAddr, err := h.dialer.Dial(req.DestAddr.Address())\n\tif err != nil {\n\t\tmsg := err.Error()\n\t\tresp := hostUnreachable\n\t\tif strings.Contains(msg, \"refused\") {\n\t\t\tresp = connectionRefused\n\t\t} else if strings.Contains(msg, \"network is unreachable\") {\n\t\t\tresp = networkUnreachable\n\t\t}\n\t\tif err := sendReply(conn, resp, nil); err != nil {\n\t\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t\t}\n\t\treturn fmt.Errorf(\"Connect to %v failed: %v\", req.DestAddr, err)\n\t}\n\tdefer target.Close()\n\n\t// Send success\n\tif err := sendReply(conn, successReply, localAddr); err != nil {\n\t\treturn fmt.Errorf(\"Failed to send reply: %v\", err)\n\t}\n\n\t// Start proxying\n\tproxyDone := make(chan error, 2)\n\n\tgo func() {\n\t\t_, e := io.Copy(target, req.bufConn)\n\t\tproxyDone <- e\n\t}()\n\n\tgo func() {\n\t\t_, e := io.Copy(conn, target)","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/socks/request_handler.go#L66-L102","documentation":"handleConnect attempts to dial the destination through the configured dialer; when Dial returns an error, it sends the mapped SOCKS failure reply and returns this error including the destination and the underlying dial error text. It means the proxy could not establish the TCP connection to the target host.","triggerScenarios":"handleConnect where h.dialer.Dial(req.DestAddr.Address()) returns an error — connection refused, network unreachable, host unreachable, DNS failure at dial time, or dial timeout.","commonSituations":"Target service down or listening on a different port (refused); firewall dropping packets (timeout/unreachable); target host offline; proxy cannot reach private/airgapped networks; typos in destination host/port configured in client applications.","solutions":["Check the wrapped underlying error text: 'refused' means the port is closed, 'unreachable' means routing/firewall issues","Verify the target service is running and listening on the requested host:port (ss/netstat on the target)","Test reachability from the proxy host directly (nc/ telnet host port) to isolate proxy vs network","Correct the destination host/port configured in the SOCKS client application","Inspect firewall/security-group rules between the proxy and the destination"],"exampleFix":"// client pointing at wrong port\nconst target = \"db.internal:5433\" // refused\n\n// after\nconst target = \"db.internal:5432\" // actual postgres port","handlingStrategy":"retry","validationCode":"// verify destination is up before requesting via the proxy\nif !isReachable(destAddr) {\n    return fmt.Errorf(\"skip proxied connect; %s unreachable\", destAddr)\n}","typeGuard":"func isReachable(target string) bool {\n    c, err := net.DialTimeout(\"tcp\", target, 3*time.Second)\n    if err != nil { return false }\n    _ = c.Close()\n    return true\n}","tryCatchPattern":"if err := connect(dest); err != nil {\n    if strings.Contains(err.Error(), \"refused\") {\n        // target port closed: alert/escalate, limited retry\n    } else if strings.Contains(err.Error(), \"unreachable\") {\n        // routing/firewall: no point retrying immediately\n    }\n}","preventionTips":["Health-check target services before routing traffic through the proxy","Confirm listening ports match client configuration (ss/netstat on target)","Audit firewall/security-group rules between proxy and destination","Add exponential backoff retries only for transient-looking failures"],"tags":["network","socks5","dial-failed","tcp"],"backgroundTag":"connection-refused","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}