cloudflare/cloudflared · error

ErrNoIngressRules

ErrNoIngressRules

Error message

The config file doesn't contain any ingress rules

What it means

ErrNoIngressRules is returned by ingress.ParseIngress (and ParseIngressFromConfigAndCLI, parseSingleOriginService) when the configuration file contains no ingress rules at all — i.e. conf is nil or conf.Ingress is empty. cloudflared requires an ingress rules list for multi-origin configuration; without one it cannot route requests.

Source

Thrown at ingress/ingress.go:22

	"fmt"
	"net"
	"net/url"
	"regexp"
	"strconv"
	"strings"

	"github.com/pkg/errors"
	"github.com/rs/zerolog"
	"github.com/urfave/cli/v2"
	"golang.org/x/net/idna"

	"github.com/cloudflare/cloudflared/config"
	"github.com/cloudflare/cloudflared/ingress/middleware"
	"github.com/cloudflare/cloudflared/ipaccess"
)

var (
	ErrNoIngressRules             = errors.New("The config file doesn't contain any ingress rules")
	ErrNoIngressRulesCLI          = errors.New("No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests")
	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)")
	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
	errHostnameContainsPort       = errors.New("Hostname cannot contain a port")
	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
)

const (
	ServiceBastion     = "bastion"
	ServiceSocksProxy  = "socks-proxy"
	ServiceWarpRouting = "warp-routing"
)

// FindMatchingRule returns the index of the Ingress Rule which matches the given
// hostname and path. This function assumes the last rule matches everything,
// which is the case if the rules were instantiated via the ingress#Validate method.
//
// Negative index rule signifies local cloudflared rules (not-user defined).

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Add an ingress rules block to the config file, ending with a catch-all rule (e.g. `- service: http_status:404`)
2. Provide single-origin via the --url flag / TUNNEL_URL instead of expecting file-based ingress
3. Use ParseIngressFromConfigAndCLI so CLI-derived rules are considered when the file has none
4. Validate the config file with `cloudflared tunnel ingress validate` before running

Example fix

// before (config.yml)
ingress: []
// after (config.yml)
ingress:
  - hostname: app.example.com
    service: http://localhost:8080
  - service: http_status:404

cfg, err := config.LoadFile(path)
if err != nil { return err }
if cfg == nil || len(cfg.Ingress) == 0 {
    return errors.New("config must define at least one ingress rule")
}

func hasIngressRules(cfg *config.Configuration) bool { return cfg != nil && len(cfg.Ingress) > 0 }

ingressRules, err := ingress.ParseIngress(conf)
if errors.Is(err, ingress.ErrNoIngressRules) {
    return fmt.Errorf("fix config: %w", err)
}

When it happens

Trigger: Calling ingress.ParseIngress(conf) with a nil config or a config whose ingress array is empty (ingress.go:89); providing a tunnel config file with only originRequest settings and no ingress: section; remote management returning a config with zero ingress rules.

Common situations: User writes a config.yml with credentials and origin URL but omits the ingress: block; config generated by tooling that skips empty ingress lists; migrating from single-origin (--url) setups to file-based config without adding rules.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• No configuration file was found. Please create one, or use t
• ErrLogConfigurationIsInvalid
• ErrNoIngressRulesCLI
• The last ingress rule must match all URLs (i.e. it should no
• too many addresses provided, max: 10

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/fc89a571e9a70a87. Report an issue: GitHub.