Setting the file. One moment.
Chapter 04 · Cloudflare Deploy
Subchapter 4.231
references/tunnel/gotchas.mdMarkdown4 KBView on GitHub
Cause: Tunnel not running or not connected Solution:
cloudflared tunnel info my-tunnel # Check status
ps aux | grep cloudflared # Verify running
journalctl -u cloudflared -n 100 # Check logsCause: Origin using self-signed certificate Solution:
originRequest:
noTLSVerify: true # Dev only
caPool: /path/to/ca.pem # Custom CACause: Origin slow to respond or timeout settings too low Solution:
originRequest:
connectTimeout: 60s
tlsTimeout: 20s
keepAliveTimeout: 120sCause: Invalid config, missing credentials, or tunnel doesn’t exist Solution:
cloudflared tunnel ingress validate # Validate config
ls -la ~/.cloudflared/*.json # Verify credentials
cloudflared tunnel list # Verify tunnel existsCause: Multiple replicas with same connector ID or stale connection Solution:
# Check active connections
cloudflared tunnel info my-tunnel
# Wait 60s for stale connection cleanup, or restart with new connector ID
cloudflared tunnel run my-tunnelCause: Old cloudflared processes using expired credentials Solution:
# Stop all cloudflared processes
pkill cloudflared
# Verify stopped
ps aux | grep cloudflared
# Restart with new credentials
cloudflared tunnel run my-tunnel| Resource/Limit | Value | Notes |
|---|---|---|
| Free tier | Unlimited tunnels | Unlimited traffic |
| Tunnel replicas | 1000 per tunnel | Max concurrent |
| Connection duration | No hard limit | Hours to days |
| Long-lived connections | May drop during updates | WebSocket, SSH, UDP |
| Replica registration | ~5s TTL | Old replica dropped after 5s no heartbeat |
| Token rotation grace | 24 hours | Old tokens work during grace period |
noTLSVerify: false)bastion service typecloudflared close to origin (same network)http2Origin: true)cloudflared tunnel ingress validate)cloudflared tunnel ingress rule <URL>)cloudflared updated (1 year support window)--no-autoupdate in prod; control updates manuallycloudflared tunnel --loglevel debug run my-tunnel
cloudflared tunnel ingress rule https://app.example.com# Ngrok: ngrok http 8000
# Cloudflare Tunnel:
ingress:
- hostname: app.example.com
service: http://localhost:8000
- service: http_status:404# Replace VPN with private network routing
warp-routing:
enabled: truecloudflared tunnel route ip add 10.0.0.0/8 my-tunnelUsers install WARP client instead of VPN.