cloudflare/cloudflared · error

unable to dial udp to origin %s: %w

Error message

unable to dial udp to origin %s: %w

What it means

Dialer.DialUDP dials a UDP 'connection' to the given netip.AddrPort using net.Dialer.Dial. If dialing fails (unresolvable address, network unreachable, permission problem), the error is wrapped with the destination and returned instead of a writeDeadlineConn-wrapped connection.

Source

Thrown at ingress/origin_dialer.go:144

			Timeout:   config.ConnectTimeout.Duration,
			KeepAlive: config.TCPKeepAlive.Duration,
		},
	}
}

func (d *Dialer) DialTCP(ctx context.Context, dest netip.AddrPort) (net.Conn, error) {
	conn, err := d.Dialer.DialContext(ctx, "tcp", dest.String())
	if err != nil {
		return nil, fmt.Errorf("unable to dial tcp to origin %s: %w", dest, err)
	}

	return conn, nil
}

func (d *Dialer) DialUDP(dest netip.AddrPort) (net.Conn, error) {
	conn, err := d.Dialer.Dial("udp", dest.String())
	if err != nil {
		return nil, fmt.Errorf("unable to dial udp to origin %s: %w", dest, err)
	}
	return &writeDeadlineConn{
		Conn: conn,
	}, nil
}

// writeDeadlineConn is a wrapper around a net.Conn that sets a write deadline of 200ms.
// This is to prevent the socket from blocking on the write operation if it were to occur. However,
// we typically never expect this to occur except under high load or kernel issues.
type writeDeadlineConn struct {
	net.Conn
}

func (w *writeDeadlineConn) Write(b []byte) (int, error) {
	if err := w.SetWriteDeadline(time.Now().Add(writeDeadlineUDP)); err != nil {
		return 0, err
	}
	return w.Conn.Write(b)

View on GitHub (pinned to 2253eeeb25)

Solutions

1. Verify the destination address and port are correct and the UDP service is running
2. Check firewall/NAT rules allow outbound UDP to the destination
3. Inspect the wrapped cause (%w) for network-unreachable vs permission-denied
4. Fall back to TCP-based transport if UDP egress is unavailable

if _, err := net.Dial("udp", dest.String()); err != nil {
	// UDP path unavailable; check firewall/egress
}

conn, err := d.DialUDP(dest)
if err != nil {
	var netErr net.Error
	if errors.As(err, &netErr) && netErr.Timeout() {
		// UDP may be silently dropped; fall back or alert
	}
	return err
}

When it happens

Trigger: Calling DialUDP against an unreachable or invalid destination, or in environments where UDP is blocked or the process lacks permission to open the socket.

Common situations: QUIC/UDP origin services behind firewalls that drop UDP, wrong port in config, or containers without UDP egress.

Related errors

• unable to dial tcp to origin %s: %w
• quick tunnel provisioning failed
• funnel not found
• invalid datagram type expected
• payload length is too large to be bundled in datagram

AI-assisted analysis of cloudflare/cloudflared@2253eeeb25 (2026-09-06). Data as JSON: /api/errors/7282ed83425ef176. Report an issue: GitHub.