What causes "unable to dial tcp to origin %s: %w" in cloudflare/cloudflared?

Confirm the origin service is running and listening on the dialed address:port (ss -tlnp / netstat)

unable to dial tcp to origin %s: %w

Error message

unable to dial tcp to origin %s: %w

What it means

Dialer.DialTCP attempts a TCP connection to the given origin netip.AddrPort using the underlying net.Dialer.DialContext. On any dial failure (DNS, refused, timeout, no route) the underlying error is wrapped with the destination address and returned; the caller receives no connection.

Source

Thrown at ingress/origin_dialer.go:135

}

type Dialer struct {
	Dialer net.Dialer
}

func NewDialer(config WarpRoutingConfig) *Dialer {
	return &Dialer{
		Dialer: net.Dialer{
			Timeout:   config.ConnectTimeout.Duration,
			KeepAlive: config.TCPKeepAlive.Duration,
		},
	}
}

func (d *Dialer) DialTCP(ctx context.Context, dest netip.AddrPort) (net.Conn, error) {
	conn, err := d.Dialer.DialContext(ctx, "tcp", dest.String())
	if err != nil {
		return nil, fmt.Errorf("unable to dial tcp to origin %s: %w", dest, err)
	}

	return conn, nil
}

func (d *Dialer) DialUDP(dest netip.AddrPort) (net.Conn, error) {
	conn, err := d.Dialer.Dial("udp", dest.String())
	if err != nil {
		return nil, fmt.Errorf("unable to dial udp to origin %s: %w", dest, err)
	}
	return &writeDeadlineConn{
		Conn: conn,
	}, nil
}

// writeDeadlineConn is a wrapper around a net.Conn that sets a write deadline of 200ms.
// This is to prevent the socket from blocking on the write operation if it were to occur. However,
// we typically never expect this to occur except under high load or kernel issues.

View on GitHub (pinned to 2253eeeb25)

Solutions

Confirm the origin service is running and listening on the dialed address:port (ss -tlnp / netstat)
Check firewalls/iptables and network reachability to the destination
Inspect the wrapped cause (%w) for refused vs timeout vs no-route to pick the right fix
Retry with a longer context deadline if the cause is a timeout

Defensive patterns

Strategy: try-catch

Validate before calling

if _, err := net.DialTimeout("tcp", dest.String(), 3*time.Second); err != nil {
	// origin unreachable; surface health-check failure before real traffic
}

Try / catch

conn, err := d.DialTCP(ctx, dest)
if err != nil {
	var netErr net.Error
	if errors.As(err, &netErr) && netErr.Timeout() {
		// retry with backoff
	}
	return fmt.Errorf("origin %s unreachable: %w", dest, err)
}

Prevention

Health-check origins before routing traffic
Pin origins to explicit IPs/ports where possible
Monitor connection-refused rates

When it happens

Trigger: Calling DialTCP when the origin is down, the port is closed, a firewall drops packets, or the context is cancelled/timed out before the connection completes.

Common situations: Origin service not started or listening on a different port, local service bound to 127.0.0.1 while the dialer targets another interface, or network interruption between cloudflared and the origin.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/85c33992404b63ba. Report an issue: GitHub.