Websocket not reachable through fqdn but it is from local

Zero Trust Cloudflare Tunnel
1

What is the name of the domain?

‘wavespacemad.online’

What is the issue you’re encountering

websocket not reachable through fqdn but it is from local

What are the steps to reproduce the issue?

My setup consists on a html webpage wich contains a javascript that connects to the websocket and sends the commands. Both the webserver and the websocket are routed through a tunnel.
If I access the website from the local IP, javascript can connect to the websocket and send commands, even being routed through the tunnel. But if I try to connect to the website from the fqdn, there is an error and the websocket isn’t able to connect. Here is the error extracted from the connector logs: 2024-08-21T13:51:31Z ERR error=“Unable to reach the origin service. The service may be down or it may not be responding to traffic from cloudflared: read tcp 172.17.0.9:38168->192.168.X.XX0:3039: read: connection
reset by peer” connIndex=2 event=1 ingressRule=16 originService=http://192.168.X.XX:3039
2024-08-21T13:51:31Z ERR Request failed error=“Unable to reach the origin service. The service may be down
or it may not be responding to traffic from cloudflared: read tcp 172.17.0.9:38168->192.168.X.XX:3039: re
ad: connection reset by peer” connIndex=2 dest=https://host360.wavespacemad.online/ event=0 ip=198.41.200.
33 type=ws

This started happening today and there haven’t been any changes from our side.

2

Due to my curiosity, may I ask if your cloudflared tunnel is locally managed?; meaning you’re using a local config file for the cloudflared tunnel to establish the WebSocket connection? :thinking:

And it’s working over HTTPS, rather WSS, correct?

4

The tunnel is running on a docker container in the same network as the websocket destination, and the configuration is pretty basic (meaning no config at all apart from the token). It was working via wss until it stopped today so I tried https with the same result.

5

May I ask if the SSL certificate is still valid for the Docker instance? :thinking:

6

The whole system was working on http (websocket and webserver) and the SSL handling was always done fully by cloudflare

7

Yep, understand. Thank you for feedback.

Did you used Flexible SSL in such case at Cloudflare → SSL/TLS settings? :thinking:

What I wonder and why I was asking, either HTTP and WS or HTTPS and WSS from my experience to remove any possible issues with the setup over hostname.

8

yep, it is using Flexible SSL and always was.
The weird thing is that it’s still working in some scenarios (certain browser+device) works but same browser but different device doesn’t.

9

After a little more digging, this seems to be related to Edge on iOS. I’ve tried several iPhones and browser combination and the only one where this doesn’t work is Edge+iOS.

10

Thank you for feedback.

Intersting :thinking: