Cloudflare Error 1033 (Tunnel error): why it happens and how to fix it
Your site runs behind a Cloudflare Tunnel, and suddenly it says “Error 1033: Cloudflare Tunnel error” (older pages say “Argo Tunnel error”). Cloudflare knows the hostname belongs to a tunnel, but nobody is on the other end of it.
1033 vs 502 behind a tunnel
| What you see | Tunnel connector | Local app | Fix |
|---|---|---|---|
| Error 1033 | Not connected | Irrelevant | Get cloudflared running and connected |
| 502 Bad Gateway | Connected | Down or wrong port | Start the app, or fix the service URL in the tunnel’s ingress rules |
| 404 from Cloudflare | Connected | — | No ingress rule matched the hostname; add it or check the catch-all |
Check the connector
# Is the service running? (Linux, installed as a service)
sudo systemctl status cloudflared
sudo journalctl -u cloudflared --since "30 min ago" | tail -50
# For locally managed tunnels: list tunnels and their live connections
cloudflared tunnel list
cloudflared tunnel info <tunnel-name>
In the dashboard, the tunnel’s status under Zero Trust → Networks → Tunnels shows Healthy, Degraded, Down or Inactive. Down or Inactive with a 1033 page is the classic pairing.
Common causes and fixes
- cloudflared stopped: restart it with
sudo systemctl restart cloudflaredand enable it at boot withsudo systemctl enable cloudflared. - The machine rebooted or lost network: the tunnel only works while the host can make outbound connections to Cloudflare on port 7844 (UDP for QUIC, TCP for HTTP/2). Some firewalls block UDP; try
--protocol http2. - Token rotated or tunnel deleted: a remotely managed tunnel needs the current token. Reinstall the service with the new token from the dashboard.
- DNS points at the wrong tunnel: the CNAME target must be the ID of the tunnel that is actually running. After recreating a tunnel, update the record, for example with
cloudflared tunnel route dns <tunnel-name> app.example.com. - Running in a laptop terminal: a quick test tunnel dies when the terminal closes. Install it as a service on a machine that stays on.
- Clock badly wrong: TLS to Cloudflare fails if the system time is far off. Check
timedatectl.
Make it survive next time
- Run
cloudflaredas a system service with restart on failure. - Run two replicas of the same tunnel on different machines if uptime matters; Cloudflare uses whichever is connected.
- Add an external uptime check on the public URL so you hear about 1033 before your visitors do.
Related
All Cloudflare error codes · 502 Bad Gateway · Cloudflare Error 1016 · Cloudflare Error 523 · localhost refused to connect · EADDRINUSE · Wirebook: how the web works
Questions
What does Cloudflare error 1033 mean?
The hostname points to a Cloudflare Tunnel, but no cloudflared connector for that tunnel is currently connected.
Is error 1033 the same as Argo Tunnel error?
Yes. Argo Tunnel was the old name for Cloudflare Tunnel, so older error pages say “Argo Tunnel error”.
How do I fix error 1033?
Start or restart cloudflared on the host, make sure it can reach Cloudflare outbound on port 7844, and check the DNS record points at the running tunnel’s ID.
Why do I get 502 instead of 1033?
A 502 means the tunnel is connected but the local app it forwards to is down or on the wrong port.
Does cloudflared need an open inbound port?
No. It only makes outbound connections, which is why a tunnel works without opening firewall ports. If outbound UDP is blocked, use the HTTP/2 protocol.
Published .