{"record":{"id":"7282ed83425ef176","repo":"cloudflare/cloudflared","slug":"unable-to-dial-udp-to-origin-s-w","errorCode":null,"errorMessage":"unable to dial udp to origin %s: %w","messagePattern":"unable to dial udp to origin (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/origin_dialer.go","lineNumber":144,"sourceCode":"\t\t\tTimeout:   config.ConnectTimeout.Duration,\n\t\t\tKeepAlive: config.TCPKeepAlive.Duration,\n\t\t},\n\t}\n}\n\nfunc (d *Dialer) DialTCP(ctx context.Context, dest netip.AddrPort) (net.Conn, error) {\n\tconn, err := d.Dialer.DialContext(ctx, \"tcp\", dest.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to dial tcp to origin %s: %w\", dest, err)\n\t}\n\n\treturn conn, nil\n}\n\nfunc (d *Dialer) DialUDP(dest netip.AddrPort) (net.Conn, error) {\n\tconn, err := d.Dialer.Dial(\"udp\", dest.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to dial udp to origin %s: %w\", dest, err)\n\t}\n\treturn &writeDeadlineConn{\n\t\tConn: conn,\n\t}, nil\n}\n\n// writeDeadlineConn is a wrapper around a net.Conn that sets a write deadline of 200ms.\n// This is to prevent the socket from blocking on the write operation if it were to occur. However,\n// we typically never expect this to occur except under high load or kernel issues.\ntype writeDeadlineConn struct {\n\tnet.Conn\n}\n\nfunc (w *writeDeadlineConn) Write(b []byte) (int, error) {\n\tif err := w.SetWriteDeadline(time.Now().Add(writeDeadlineUDP)); err != nil {\n\t\treturn 0, err\n\t}\n\treturn w.Conn.Write(b)","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/origin_dialer.go#L126-L162","documentation":"Dialer.DialUDP dials a UDP 'connection' to the given netip.AddrPort using net.Dialer.Dial. If dialing fails (unresolvable address, network unreachable, permission problem), the error is wrapped with the destination and returned instead of a writeDeadlineConn-wrapped connection.","triggerScenarios":"Calling DialUDP against an unreachable or invalid destination, or in environments where UDP is blocked or the process lacks permission to open the socket.","commonSituations":"QUIC/UDP origin services behind firewalls that drop UDP, wrong port in config, or containers without UDP egress.","solutions":["Verify the destination address and port are correct and the UDP service is running","Check firewall/NAT rules allow outbound UDP to the destination","Inspect the wrapped cause (%w) for network-unreachable vs permission-denied","Fall back to TCP-based transport if UDP egress is unavailable"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if _, err := net.Dial(\"udp\", dest.String()); err != nil {\n\t// UDP path unavailable; check firewall/egress\n}","typeGuard":null,"tryCatchPattern":"conn, err := d.DialUDP(dest)\nif err != nil {\n\tvar netErr net.Error\n\tif errors.As(err, &netErr) && netErr.Timeout() {\n\t\t// UDP may be silently dropped; fall back or alert\n\t}\n\treturn err\n}","preventionTips":["Verify UDP egress in firewalls/NAT for the origin","Test UDP connectivity during deployment","Prefer explicit IP destinations to avoid resolution issues"],"tags":["udp","dial","origin","network"],"backgroundTag":"network-request-failed","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}