Troubleshooting Argo Tunnel

Performance Argo Tunnel
#1

I’m hosting a NextCloud instance behind a NGINX reverse proxy.

Everything works (ie: I’m able to get to the login page of nextcloud that’s hosted internally) when Cloudflare DNS CNAME record (nextcloud) is setup to be Proxied through my domain’s A record; however, when I change the CNAME to go through the Argo tunnel via the tunnel-id, I get a HTTP 502/Bad Gateway error. BTW, my Argo Tunnel is setup and working as I’m hosting other internal services via the tunnel.

To summarize, when accessing internal service like NextCloud via Cloudflare Proxy that goes through my reverse proxy, things work; however, when going through the Argo Tunnel (ie: by passing the nginx reverse proxy), I get a Bad Gateway error.

Any ideas why this could be happening?

#2

On your machine running the cloudflared instance if you do something like curl -Ikv https://www.example.com -resolve www.example.com:443:my.internal.ip.address does that work?

If you do a dig for whatever hostname you’ve specified as the origin for that host on the machine running cloudflared does it resolve to the proper host/IP?

#3

Thanks so much for a quick response!

I wanted to confirm the command syntax:

curl -Ikv https://nextcloud.mydomain.com -resolve nextcloud.mydomain.com:443:192.168.2.20

?

Doing a ‘dig nextcloud.mydoman.com’ does return two A records for Cloudflare Proxy:
image

I doubt that this is a DNS resolution issue since I can access the internal service via the Cloudflare Proxy. The issue might be more Tunnel related.

#4

curl -Ikv https://nextcloud.mydomain.com --resolve nextcloud.mydomain.com:443:192.168.2.20

needs an extra dash… my apologies… it’s been a long week. :slight_smile:

1 Like
#5

TGIF !! :slight_smile:

Command Run:

curl -Ikv https://nextcloud.mydomain.com -resolve nextcloud.mydomain.com:444:192.168.2.20

Please note that the target origin port is running https on 444 (instead of the default 443).

Here’s the output with the exact domain & IPs masked and/or changed:

`* Added nextcloud.mydomain.com:444:192.168.2.20 to DNS cache

  • Trying 2606:4700:XXXX:XXXX:XXXX:443…
  • Connected to nextcloud.mydomain.com (2606:4700:XXXX:XXXX:XXXX) port 443 (#0) ALPN, offering h2 ALPN, offering http/1.1 successfully set certificate verify locations:
  • CAfile: none
  • CApath: /etc/ssl/certs
  • TLSv1.3 (OUT), TLS handshake, Client hello (1):
  • TLSv1.3 (IN), TLS handshake, Server hello (2):
  • TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
  • TLSv1.3 (IN), TLS handshake, Certificate (11):
  • TLSv1.3 (IN), TLS handshake, CERT verify (15):
  • TLSv1.3 (IN), TLS handshake, Finished (20):
  • TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
  • TLSv1.3 (OUT), TLS handshake, Finished (20):
  • SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
  • ALPN, server accepted to use h2
  • Server certificate:
  • subject: C=US; ST=CA; L=San Francisco; O=Cloudflare, Inc.; CN=sni.cloudflaressl.com
  • start date: Jan 21 00:00:00 2021 GMT
  • expire date: Jan 20 23:59:59 2022 GMT
  • issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare Inc ECC CA-3
  • SSL certificate verify ok.
  • Using HTTP2, server supports multi-use
  • Connection state changed (HTTP/2 confirmed)
  • Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
  • Using Stream ID: 1 (easy handle 0x47c540)

HEAD / HTTP/2
Host: nextcloud.mydomain.com
user-agent: curl/7.73.0
accept: /

<

#6

Is your yml file pointing to something like https://192.168.2.20:444 ?

#7

It’s pointing to https://localhost:444

#8

What happens if you change it to this?