Common errors

import { GlossaryTooltip, Render } from "~/components";

This section covers the most common errors you might encounter when connecting resources with Cloudflare Tunnel. If you do not see your issue listed below, refer to Troubleshooting Cloudflare One, view your Tunnel logs, or contact Cloudflare Support.

Tunnel status

You can check your tunnel's connection status either from the Cloudflare dashboard (by going to Networking > Tunnels) or by running the cloudflared tunnel list command. Each tunnel displays a status that reflects its current connection state:

:::note[Tunnel status scope]

The tunnel status only reflects the connection between cloudflared and the Cloudflare network. Tunnel status does not indicate whether cloudflared can successfully reach your internal services. As a result, a tunnel can appear Healthy while users are still unable to connect to an application. :::

<Render file="tunnel/common-errors" product="cloudflare-one" params={{ logsURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/monitor-tunnels/logs/", protocolURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/routing-to-tunnel/protocols/", configFileURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/local-management/configuration-file/", originServerNameURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#originservername", caPoolURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#capool", noTLSVerifyURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/origin-parameters/#notlsverify", httpsOriginURL: "/tunnel/troubleshooting/https-origins/", ulimitsURL: "/cloudflare-one/networks/connectors/cloudflare-tunnel/configure-tunnels/tunnel-availability/system-requirements/#ulimits", }} />

My tunnel randomly disconnects.

Long-lived connections initiated through Cloudflare One, such as SSH sessions, can last up to eight hours. However, disruptions along the service path may result in more frequent disconnects. Often, these disconnects are caused by regularly scheduled maintenance events such as data center, server, or service updates and restarts. If you believe these events are not the cause of disconnects in your environment, collect the relevant client logs and Tunnel logs and contact Support.

If the disconnects mainly affect idle SSH sessions, WebSocket connections, or other long-lived connections, the transport protocol may be relevant.

When cloudflared uses QUIC, idle sessions can be more sensitive to network devices that aggressively time out UDP traffic. If idle connections drop repeatedly, try one or more of the following:

• Configure application-layer keepalives, such as ServerAliveInterval for SSH.
• Test with cloudflared set to protocol: http2.
• Review local firewalls, NAT devices, and upstream network equipment for short UDP idle timers.

For connection setup failures caused by blocked QUIC traffic, refer to the QUIC troubleshooting sections above.

ping and traceroute commands do not work.

To ping an IP address behind Cloudflare Tunnel, your system must allow ICMP traffic through cloudflared. For configuration instructions, refer to the ICMP proxy documentation.

I see Error: This route's network is inside an existing subnet's network at "100.96.0.0/12".

This error occurs when you try to add a CIDR route that falls within the Cloudflare One Client's CGNAT IP range. The 100.96.0.0/12 range, which covers addresses from 100.96.0.1 to 100.111.255.254, is reserved for internal WARP routing and cannot be added as a Cloudflare Tunnel route. To connect your private network, you will need to change its IP/CIDR so that it does not overlap with 100.96.0.0/12.

I see This site can't provide a secure connection.

If you see an error with the title This site can't provide a secure connection and a subtitle of <hostname> uses an unsupported protocol, you must order an Advanced Certificate.

If you added a multi-level subdomain (more than one level of subdomain), you must order an Advanced Certificate for the hostname as Cloudflare's Universal certificate will not cover the public hostname by default.

For more information on Tunnel errors, view your Tunnel logs or contact Cloudflare Support.