{"record":{"id":"85c33992404b63ba","repo":"cloudflare/cloudflared","slug":"unable-to-dial-tcp-to-origin-s-w","errorCode":null,"errorMessage":"unable to dial tcp to origin %s: %w","messagePattern":"unable to dial tcp to origin (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ingress/origin_dialer.go","lineNumber":135,"sourceCode":"}\n\ntype Dialer struct {\n\tDialer net.Dialer\n}\n\nfunc NewDialer(config WarpRoutingConfig) *Dialer {\n\treturn &Dialer{\n\t\tDialer: net.Dialer{\n\t\t\tTimeout:   config.ConnectTimeout.Duration,\n\t\t\tKeepAlive: config.TCPKeepAlive.Duration,\n\t\t},\n\t}\n}\n\nfunc (d *Dialer) DialTCP(ctx context.Context, dest netip.AddrPort) (net.Conn, error) {\n\tconn, err := d.Dialer.DialContext(ctx, \"tcp\", dest.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to dial tcp to origin %s: %w\", dest, err)\n\t}\n\n\treturn conn, nil\n}\n\nfunc (d *Dialer) DialUDP(dest netip.AddrPort) (net.Conn, error) {\n\tconn, err := d.Dialer.Dial(\"udp\", dest.String())\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to dial udp to origin %s: %w\", dest, err)\n\t}\n\treturn &writeDeadlineConn{\n\t\tConn: conn,\n\t}, nil\n}\n\n// writeDeadlineConn is a wrapper around a net.Conn that sets a write deadline of 200ms.\n// This is to prevent the socket from blocking on the write operation if it were to occur. However,\n// we typically never expect this to occur except under high load or kernel issues.","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/cloudflare/cloudflared/blob/2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f/ingress/origin_dialer.go#L117-L153","documentation":"Dialer.DialTCP attempts a TCP connection to the given origin netip.AddrPort using the underlying net.Dialer.DialContext. On any dial failure (DNS, refused, timeout, no route) the underlying error is wrapped with the destination address and returned; the caller receives no connection.","triggerScenarios":"Calling DialTCP when the origin is down, the port is closed, a firewall drops packets, or the context is cancelled/timed out before the connection completes.","commonSituations":"Origin service not started or listening on a different port, local service bound to 127.0.0.1 while the dialer targets another interface, or network interruption between cloudflared and the origin.","solutions":["Confirm the origin service is running and listening on the dialed address:port (ss -tlnp / netstat)","Check firewalls/iptables and network reachability to the destination","Inspect the wrapped cause (%w) for refused vs timeout vs no-route to pick the right fix","Retry with a longer context deadline if the cause is a timeout"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if _, err := net.DialTimeout(\"tcp\", dest.String(), 3*time.Second); err != nil {\n\t// origin unreachable; surface health-check failure before real traffic\n}","typeGuard":null,"tryCatchPattern":"conn, err := d.DialTCP(ctx, dest)\nif err != nil {\n\tvar netErr net.Error\n\tif errors.As(err, &netErr) && netErr.Timeout() {\n\t\t// retry with backoff\n\t}\n\treturn fmt.Errorf(\"origin %s unreachable: %w\", dest, err)\n}","preventionTips":["Health-check origins before routing traffic","Pin origins to explicit IPs/ports where possible","Monitor connection-refused rates"],"tags":["tcp","dial","origin","network"],"backgroundTag":"connection-refused","analyzedSha":"2253eeeb25a44a713a4b60b8ba1e1b3f377d1a0f","analyzedAt":"2026-09-06T04:14:33.757Z","contentChangedAt":"2026-09-06T04:14:33.757Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}