Learn how to fix Cloudflared tunnels that show connected but still time out. Debug DNS mismatch, Nginx upstream issues, origin unreachable errors, and credential failures.
Few self-hosting problems are more frustrating than this.
You run your tunnel.
Cloudflared shows:
Connected to CloudflareEverything looks healthy.
No obvious errors.
Yet your public domain still times out.
The browser spins endlessly.
No response.
No useful error.
If you've ever self-hosted a Next.js app, internal dashboard, or Linux service behind Cloudflare Tunnel, you've probably seen this exact situation.
The tunnel is active.
But the site is still unreachable.
This guide walks through the complete production debugging workflow for fixing Cloudflared tunnels that appear connected but fail to serve traffic.
When a tunnel is connected but inaccessible, the problem usually falls into one of these categories:
1. DNS mismatch
2. Incorrect tunnel ingress config
3. Origin service unreachable
4. Nginx upstream failure
5. Credential or routing issues
Let's debug each one.
---
Start by checking tunnel status:
cloudflared tunnel listHealthy output should show:
STATUS: healthyThen inspect logs:
journalctl -u cloudflared -fLook for:
Registered tunnel connection
Connection establishedBad signs include:
Tunnel credentials file doesn't exist
Unauthorized
Failed to serve tunnel connectionIf credentials are broken, skip to Step 6.
---
This is the most common real-world failure.
Your tunnel is healthy, but DNS points somewhere else.
Check your DNS record in Cloudflare.
For a tunnel-backed domain, you should have:
Type: CNAME
Name: yourdomain.com
Target: <tunnel-id>.cfargotunnel.com
Proxy: Enabled---
Run:
dig yourdomain.comor:
nslookup yourdomain.comIf resolution doesn't match your tunnel endpoint, DNS is misconfigured.
---
Cloudflare may still point traffic to an old VPS IP.
Remove stale A records.
---
If both A and CNAME exist, routing becomes unpredictable.
Use one authoritative tunnel record.
---
A typo in tunnel UUID breaks routing entirely.
---
Inspect:
/etc/cloudflared/config.ymlExample working config:
tunnel: your-tunnel-id
credentials-file: /root/.cloudflared/your-tunnel.json
ingress:
- hostname: yourdomain.com
service: http://localhost:3000
- service: http_status:404---
Example:
service: http://localhost:3001while your app runs on:
localhost:3000This creates silent timeout behavior.
---
If ingress hostname doesn't match DNS hostname, routing fails.
---
Even small indentation errors break routing.
Validate carefully.
---
Cloudflare Tunnel only proxies.
Your local service must actually respond.
Test directly on the server:
curl http://localhost:3000Healthy response:
<!DOCTYPE html>
<html>If curl hangs or fails, your tunnel is fine.
Your app is not.
---
Check:
pm2 statusor:
ps aux | grep node---
You may see:
EADDRINUSEAnother service already owns the port.
---
Verify logs:
pm2 logs your-app---
If Cloudflared points to Nginx instead of directly to Next.js:
service: http://localhost:80Then Nginx becomes part of the chain.
Validate config:
sudo nginx -tThen inspect upstream:
location / {
proxy_pass http://127.0.0.1:3000;
}---
Nginx proxies to dead service.
---
For Next.js:
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";---
After config changes:
sudo systemctl reload nginx---
Credential corruption causes misleading partial connections.
Check:
ls ~/.cloudflaredYou should see:
---
If missing:
Re-authenticate:
cloudflared tunnel loginThen recreate credentials:
cloudflared tunnel create mytunnel---
Tunnel credentials file doesn't existor:
Unauthorized: failed authenticationThese require credential regeneration.
---
Validate every layer.
---
curl localhost:3000---
curl localhost:80---
curl https://yourdomain.comFind the exact layer where failure begins.
This isolates the issue fast.
---
When a connected tunnel times out, I run this exact flow:
cloudflared tunnel list
journalctl -u cloudflared -f
curl localhost:3000
sudo nginx -t
pm2 status
dig yourdomain.comThis usually identifies the issue within minutes.
---
To avoid future tunnel failures:
sudo systemctl enable cloudflared---
Persistent logging catches failures early.
---
Avoid unnecessary routing layers.
---
Cloudflare dashboard mistakes are common.
---
Always verify origin first.
---
A connected Cloudflared tunnel does not guarantee a reachable site.
Think of the request path like this:
Cloudflare Edge → Tunnel → Local Connector → Nginx → AppA failure anywhere in that chain causes timeouts.
The key is methodical isolation.
Check each layer.
Validate assumptions.
Debug from local origin outward.
That’s how production tunnel issues get solved fast.