522 Timeout Error with Caddy Reverse Proxy

[user2202]

What is the name of the domain?

‘vikunja.geffro.com’

What is the error number?

522

What is the error message?

The initial connection between Cloudflare’s network and the origin web server timed out. As a result, the web page can not be displayed.

What is the issue you’re encountering

Hey Everyone! I’m trying to start self hosting some services for my self over the web, starting with Vikunja. I’ve got it set up on a server sitting on a DMZ subnet Here’s my set up: With Cloudflare I made DNS records for the root domain and the sub-domains pointing to my WAN address. Made 2 rules on the WAN interface to allow any traffic with the destination of my Firewall on HTTP+HTTPS. Made DMZ rules (where my Server is) allowing HTTP + HTTPS traffic with a destination of my Firewall. Set up Caddy plugin on my FW with my domains and it looks like the certificates are fine. My subnets are segregated but the DMZ subnet has access to the internet. Made DMZ rules allowing HTTP + HTTPS traffic with a destination of my Server.

What steps have you taken to resolve the issue?

I’ve looked at some other related pages on here but it won’t let me post them.

I’ve tried:
I can connect to Vikunja through the Server’s IP and port locally.
Turning off SSL/TLS in Cloudflare.
I used curl to look at the certificate on the server and it looks fine.
Allowed Cloudflare IP ranges.
Tracert completes and resolves to a Cloudflare address (I have proxied records on)
Flushed DNS
Tried to access from a different network

What are the steps to reproduce the issue?

Try to access the site

Screenshot of the error

[sufi]

Hey there,

A 522 error typically indicates that Cloudflare cannot access your origin server. Considering you can access Vikunja locally, the problem is probably associated with firewall rules, NAT, or Cloudflare configuration.

Have you verified that the firewall is correctly transmitting HTTP (80) and HTTPS (443) to the Vikunja server’s private IP address in the DMZ? If you’re using Caddy as a reverse proxy, make sure it’s listening on the appropriate ports and directing traffic to Vikunja’s local IP and port.

[user2202]

hey sufi, thanks for responding!

so, I use an Opnsense FW with the Caddy plugin.

I’ve double checked the reverse proxy set up here:

The FW rules I’ve also checked are allowing web traffic in to the FW/server and the Cloudflare DNS records look ok.