cloudflare/cloudflared · warning

ErrNoIngressRulesCLI

ErrNoIngressRulesCLI

Error message

No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests

What it means

ErrNoIngressRulesCLI is returned by ParseIngressFromConfigAndCLI, parseSingleOriginService, and RoundTrip when neither the config file nor the CLI flags define any ingress rules. Unlike ErrNoIngressRules it is a soft condition: cloudflared falls back to a default origin and will return 503 for all incoming HTTP requests unless remote configuration supplies rules.

Source

Thrown at ingress/ingress.go:23

	"net"
	"net/url"
	"regexp"
	"strconv"
	"strings"

	"github.com/pkg/errors"
	"github.com/rs/zerolog"
	"github.com/urfave/cli/v2"
	"golang.org/x/net/idna"

	"github.com/cloudflare/cloudflared/config"
	"github.com/cloudflare/cloudflared/ingress/middleware"
	"github.com/cloudflare/cloudflared/ipaccess"
)

var (
	ErrNoIngressRules             = errors.New("The config file doesn't contain any ingress rules")
	ErrNoIngressRulesCLI          = errors.New("No ingress rules were defined in provided config (if any) nor from the cli, cloudflared will return 503 for all incoming HTTP requests")
	errLastRuleNotCatchAll        = errors.New("The last ingress rule must match all URLs (i.e. it should not have a hostname or path filter)")
	errBadWildcard                = errors.New("Hostname patterns can have at most one wildcard character (\"*\") and it can only be used for subdomains, e.g. \"*.example.com\"")
	errHostnameContainsPort       = errors.New("Hostname cannot contain a port")
	ErrURLIncompatibleWithIngress = errors.New("You can't set the --url flag (or $TUNNEL_URL) when using multiple-origin ingress rules")
)

const (
	ServiceBastion     = "bastion"
	ServiceSocksProxy  = "socks-proxy"
	ServiceWarpRouting = "warp-routing"
)

// FindMatchingRule returns the index of the Ingress Rule which matches the given
// hostname and path. This function assumes the last rule matches everything,
// which is the case if the rules were instantiated via the ingress#Validate method.
//
// Negative index rule signifies local cloudflared rules (not-user defined).
func (ing Ingress) FindMatchingRule(hostname, path string) (*Rule, int) {

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Define ingress rules in the config file, or pass --url to set a single origin
2. Pass a tunnel token so remote configuration can supply ingress rules
3. Treat this as a warning: confirm the fallback default origin (newDefaultOrigin) is acceptable
4. Run `cloudflared tunnel ingress validate` (or `cloudflared tunnel ingress rule ...`) to verify rules resolve before serving

Example fix

// before
cloudflared tunnel run mytunnel  // no config ingress, no --url -> 503s
// after
cloudflared tunnel --url http://localhost:8080 run mytunnel
// or add to config.yml:
// ingress:
//   - service: http://localhost:8080
//   - service: http_status:404

if !cmd.IsSet("url") && !cmd.IsSet("token") && (cfg == nil || len(cfg.Ingress) == 0) {
    log.Warn().Msg("no ingress rules and no origin: all requests will get 503 until remote config loads")
}

func hasAnyIngressSource(cfg *config.Configuration, cmd IsSetFn) bool {
    return (cfg != nil && len(cfg.Ingress) > 0) || cmd.IsSet("url") || cmd.IsSet("token")
}

rules, err := ingress.ParseIngressFromConfigAndCLI(c, flags, log)
if errors.Is(err, ingress.ErrNoIngressRulesCLI) {
    log.Warn().Msg("falling back to default origin; requests will 503 until remote config arrives")
    rules = newDefaultOrigin(c, log)
}

When it happens

Trigger: Running cloudflared with no ingress block in the config file and no --url/single-origin CLI flag (ingress.go:112-116); starting a token-less tunnel where no local rules exist so the warning is logged via log.Warn().Msg(ErrNoIngressRulesCLI.Error()); RoundTrip encountering a config with zero rules from both sources.

Common situations: Launching cloudflared with only a token and no local ingress config; forgetting --url when no config file exists; config file present but with no ingress section and no CLI origin flags, causing every request to get 503.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• No configuration file was found. Please create one, or use t
• cloudflared tunnel rule expects a single argument, the URL t
• ErrNoIngressRules
• The last ingress rule must match all URLs (i.e. it should no
• ErrURLIncompatibleWithIngress

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/cdc7eaae36191cb5. Report an issue: GitHub.