cloudflare/cloudflared · error

Connect to %v failed: %v

Error message

Connect to %v failed: %v

What it means

handleConnect attempts to dial the destination through the configured dialer; when Dial returns an error, it sends the mapped SOCKS failure reply and returns this error including the destination and the underlying dial error text. It means the proxy could not establish the TCP connection to the target host.

Source

Thrown at socks/request_handler.go:84

				return fmt.Errorf("Connect to %v denied due to iprule: %s", req.DestAddr, rule.String())
			}
			return fmt.Errorf("Connect to %v denied", req.DestAddr)
		}
	}

	target, localAddr, err := h.dialer.Dial(req.DestAddr.Address())
	if err != nil {
		msg := err.Error()
		resp := hostUnreachable
		if strings.Contains(msg, "refused") {
			resp = connectionRefused
		} else if strings.Contains(msg, "network is unreachable") {
			resp = networkUnreachable
		}
		if err := sendReply(conn, resp, nil); err != nil {
			return fmt.Errorf("Failed to send reply: %v", err)
		}
		return fmt.Errorf("Connect to %v failed: %v", req.DestAddr, err)
	}
	defer target.Close()

	// Send success
	if err := sendReply(conn, successReply, localAddr); err != nil {
		return fmt.Errorf("Failed to send reply: %v", err)
	}

	// Start proxying
	proxyDone := make(chan error, 2)

	go func() {
		_, e := io.Copy(target, req.bufConn)
		proxyDone <- e
	}()

	go func() {
		_, e := io.Copy(conn, target)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Check the wrapped underlying error text: 'refused' means the port is closed, 'unreachable' means routing/firewall issues
2. Verify the target service is running and listening on the requested host:port (ss/netstat on the target)
3. Test reachability from the proxy host directly (nc/ telnet host port) to isolate proxy vs network
4. Correct the destination host/port configured in the SOCKS client application
5. Inspect firewall/security-group rules between the proxy and the destination

Example fix

// client pointing at wrong port
const target = "db.internal:5433" // refused

// after
const target = "db.internal:5432" // actual postgres port

// verify destination is up before requesting via the proxy
if !isReachable(destAddr) {
    return fmt.Errorf("skip proxied connect; %s unreachable", destAddr)
}

func isReachable(target string) bool {
    c, err := net.DialTimeout("tcp", target, 3*time.Second)
    if err != nil { return false }
    _ = c.Close()
    return true
}

if err := connect(dest); err != nil {
    if strings.Contains(err.Error(), "refused") {
        // target port closed: alert/escalate, limited retry
    } else if strings.Contains(err.Error(), "unreachable") {
        // routing/firewall: no point retrying immediately
    }
}

When it happens

Trigger: handleConnect where h.dialer.Dial(req.DestAddr.Address()) returns an error — connection refused, network unreachable, host unreachable, DNS failure at dial time, or dial timeout.

Common situations: Target service down or listening on a different port (refused); firewall dropping packets (timeout/unreachable); target host offline; proxy cannot reach private/airgapped networks; typos in destination host/port configured in client applications.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• unable to dial tcp to origin %s: %w
• Failed to read auth methods: %v
• not a tcp connection
• Failed to get command version: %v
• Unsupported command version: %v

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/4a3d04f44482e6aa. Report an issue: GitHub.