Can access my webserver via public IP, not by URL Error 522

[user2675]

I’ve running an unraid server behind a pfsense firewall.
Unraid is running SWAG which is acting as a reverse proxy, and a tiny webserver. ( Nothing really but a splash page)
I’ve configured SSL certificates, I’ve forwarded 80 and 443 to my swag container which handles the reverse proxy for any wildcards I plan to add down the line.

I can access my swag landing page via public IP, but not by URL.
I’ve got A record configured, which gets routinely updated via cloudflare docker container, and a www cname point to @.

When I try and navigate to my url, I get a cloudflare 522 error.

On my pfsense box I’ve uninstalled PFblocker, thinking that may have been the issue.
I have run packet captures on the internal host IP address, and see the TCP packets for 80 and 443 get to the host just fine. So there is no blocking of cloudflares IPs.

I used this to see what my issue was:

Diagnostic Center | Check SSL and Test Website Security | Cloudflare

And here’s what I got.

[fritex]

@user2675

pfsense firewall

@user2675

So there is no blocking of cloudflares IPs

May I ask you to re-check if Cloudflare is allowed to connect to your origin host to as follows in the below article?

• https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

• https://www.cloudflare.com/ips/

@user2675

SWAG which is acting as a reverse proxy, and a tiny webserver

@user2675

I’ve configured SSL certificates, I’ve forwarded 80 and 443

So, your Website is not secured?
May I ask before moving to Cloudflare, was your Website working over HTTPS connection or not?
If yes, is the SSL certificate self-signed or from Let’s Encrypt, or purchased maybe for your domain name + www prefix + some other possible (or not) sub-domain?

May I ask what SSL option have you got selected under the SSL/TLS tab at Cloudflare dashboard for your domain ( Flexible, Full, Full Strict … )?

@user2675

522 error

Regarding Cloudflare 522 error, may I suggest you to try looking into below articles to troubleshoot the issue:

Community Tip - Fixing Error 522: Connection timed out

Error Try the suggestions in this Community Tip to help you fix Error 522 “ERR CONNECTION TIMED OUT” in Google Chrome or “The connection has timed out” in Firefox. Background A 522 error happens when a TCP connection to the web server could not be established. This typically happens when Cloudflare requests to the origin (your webserver) get blocked. When this happens, you’ll see “ERR_CONNECTION_TIMED_OUT”. [PRO UP SELL] Quick Fix Ideas Make sure that you’re not blocking Cloudflare IPs i…

@user2675

and a www cname point to @

Both are proxied and set to ?

From your screenshot I see:

• HTTPS → response status of 400.

May I ask if you can post a screenshot of this 400 error? Is it coming from your origin host/server or rather from Cloudflare?

How about below two options at Cloudflare dashboard for your domain name?:

1. Always Use HTTPS
2. Automatic HTTPS Rewrites

Are they enabled or disabled?

[user2675]

@fritex

May I ask you to re-check if Cloudflare is allowed to connect to your origin host to as follows in the below article?

• https://support.cloudflare.com/hc/en-us/articles/201897700-Allowing-Cloudflare-IP-addresses

Nevertheless, Cloudflare IP addresses list can be found here:

• https://www.cloudflare.com/ips/

As I said, not the issue.

@fritex

So, your Website is not secured?
May I ask before moving to Cloudflare, was your Website working over HTTPS connection or not?
If yes, is the SSL certificate self-signed or from Let’s Encrypt, or purchased maybe for your domain name + www prefix + some other possible (or not) sub-domain?

May I ask what SSL option have you got selected under the SSL/TLS tab at Cloudflare dashboard for your domain ( Flexible, Full, Full Strict … )?

Incorrect. My website is secured.
There was no before cloudflare. SSL cert is from lets’ encrypt. SSL option is Full, I’ve tried every option. Changing this setting did not remedy the issue.

I’ve read all the community tips, and about 12 hours of testing,rechecking, google article reading etc.

@fritex

Both are proxied and set to ?

Correct

@fritex

From your screenshot I see:

• HTTPS → response status of 400.

May I ask if you can post a screenshot of this 400 error? Is it coming from your origin host/server or rather from Cloudflare?

This is coming from the Cloudflare diagnostic. From the client, I get 522.

@fritex

How about below two options at Cloudflare dashboard for your domain name?:

1. Always Use HTTPS
2. Automatic HTTPS Rewrites

Are they enabled or disabled?

I am unable to find these in the dashboard.

[fritex]

@user2675

unable to find these in the dashboard

Ou sorry, my bad. I didn’t linked this properly.

• Kindly, navigate to the SSL/TLS tab → select Edge Certificates and scroll down a bit to see these sections

[user2675]

@fritex

• Always Use HTTPS
• Automatic HTTPS Rewrites

Always use HTTPS is off.
Automatic HTTPS Rewrites is on.

[fritex]

Does something change when you set as follows from below?:

• SSL/TLS → Full (Strict) SSL
• Always Use HTTPS → on (enable)

Give it a few minutes to apply the changes.
Try using a different Web browser, if not already, if any difference.

Furthermore, may I ask what is your domain name so I could also check this too, if it’s appropriate to share?

@user2675

Correct

And both are pointed to the pfSense IP address or the origin host/server (where the proxy is installed)?

Does pfSense need … hm, the SSL certificate to be added or, I might be thinking of something while writing … sorry.

Have you checked your web server config file?

SWAG setup

[user2675]

@fritex

Does something change when you set as follows from below?:

• SSL/TLS → Full (Strict) SSL
• Always Use HTTPS → on (enable)

Give it a few minutes to apply the changes.
Try using a different Web browser, if not already, if any difference.

No change

@fritex

Furthermore, may I ask what is your domain name so I could also check this too, if it’s appropriate to share?

Sorry cannot post that.

@fritex

Have you checked your web server config file?

Yes I have, everything appears to be configured correctly.

[user2675]

Bumping for the morning crowd.

[user2675]

Still looking for resolution.

[sdayman]

@user2675

@fritex

Both are proxied and set to ?

Correct

Does it work with HTTPS if it’s set to DNS Only?

[user2675]

YES IT DOES! I definitely don’t want my public ip out there…does this information offer a resolution??

[sdayman]

It certainly indicates that something at your end is blocking Cloudflare.

@user2675

I can access my swag landing page via public IP

Is this Cloudflare’s public IP? Or is it your origin’s public IP?

Is there a way to temporarily take pfsense out of the connection?

[user2675]

oh ok. Interesting. I’ve wiresharked the host machine, and the traffic is getting to the host machine.
I can acess my swag landing page from my ISP public IP, NOT from the cloudflare IP.

[sdayman]

@user2675

and the traffic is getting to the host machine.

And what about back out? It’s stopping somewhere.

@user2675

NOT from the cloudflare IP.

That doesn’t surprise me, as Cloudflare won’t forward the request if there’s no hostname.

[user2675]

You’re the man! I ended up adding the cloudflare ip list as an alias, then put a pass rule on WAN for traffic from that alias to host machine.

Works perfectly now! Thank you so much!