Cloudflare Error 523: Origin is unreachable

Cloudflare’s edge cannot find a working path to your origin at all — not a polite TCP refuse, not a slow connect, not a hung HTTP read. The packets have nowhere useful to go.

What visitors see

Error 523
Origin is unreachable
Cloudflare could not reach the origin web server.
Cloudflare Ray ID: …

Only orange-cloud (proxied) hostnames show this branded page. Grey-cloud traffic goes straight to the origin IP and never hits Cloudflare’s 5xx series — which is useful for diagnosis.

523 vs 521 vs 522 vs 524 vs 520

Rule of thumb: 523 is a reachability / routing problem. Opening a local port or raising proxy_read_timeout will not fix it. Fix the IP Cloudflare dials, the path from Cloudflare’s network to that IP, and any allowlist that must include Cloudflare’s published ranges.

Frequent real causes

• Wrong or stale origin IP in Cloudflare DNS — A/AAAA still points at an old VPS, a decommissioned load balancer, or a private RFC1918 address Cloudflare cannot route to.
• Broken or missing AAAA — IPv6 record exists but the origin (or the path to it) does not accept IPv6 from Cloudflare PoPs. Prefer a working AAAA or remove the bad one.
• Origin host / VPC / ISP path down — server powered off, provider routing incident, or a blackhole between Cloudflare’s ASN and yours. From your laptop the site may still “work” via a different path.
• Firewall / security group that drops Cloudflare entirely — allowlist that never included Cloudflare IP ranges, or that expired after a range update. Closely related to 522 when packets are DROP’d after a route exists; 523 when the edge reports the destination unreachable.
• Tunnel / Spectrum / GRE misconceptions — expecting Cloudflare Tunnel (cloudflared) behaviour while the DNS record still points at a public origin IP that is gone; or Spectrum/TCP proxy pointed at an unreachable backend. (Legacy Railgun is retired — migrate off it; do not chase Railgun settings for new 523s.)
• Argo / regional routing oddities — rare; usually still an origin-IP or allowlist issue. Confirm the origin answers from multiple regions before blaming Argo.
• Origin only reachable on a private VPN — Cloudflare’s public PoPs are not on your WireGuard mesh. Use Cloudflare Tunnel (outbound from origin) instead of a public A record to a private IP.

Diagnose

# What IP does the world (and CF DNS) think is origin?
dig +short example.com A
dig +short example.com AAAA
# In Cloudflare dashboard: DNS → confirm proxied record target IP matches the live origin

# Can YOU reach that IP on 80/443? (not the same path as CF, but a start)
curl -sI --connect-timeout 5 http://ORIGIN_IP/ -H "Host: example.com"
curl -sI --connect-timeout 5 https://ORIGIN_IP/ -H "Host: example.com" -k

# From the origin: confirm it has a public default route and listens
ip route | head
ss -lntup | grep -E ':80|:443'
curl -4 -s ifconfig.me; echo   # public IPv4 the host thinks it has

# Cloudflare IP allowlist (update when CF publishes new ranges):
# https://www.cloudflare.com/ips/  →  allow those in ufw/security-group/nginx real_ip
# Example sketch (IPv4 only — also add IPv6 ranges):
# for cidr in $(curl -fsS https://www.cloudflare.com/ips-v4); do
#   sudo ufw allow from "$cidr" to any port 443 proto tcp
# done

# Grey-cloud temporarily to see whether the origin answers without the proxy:
# Cloudflare DNS → click orange cloud → grey → dig again → curl https://example.com/

If dig shows an IP that is not your current server, fix DNS first. If the IP is correct but every Cloudflare PoP still 523s while a direct (grey-cloud) hit works, suspect allowlists, IPv6, or provider routing toward Cloudflare’s ASN.

Fix checklist

1. Confirm it is 523 — refused → 521; connect timeout → 522; empty/invalid reply → 520; slow HTTP → 524; TLS → 525/526.
2. Align DNS with the live origin — A/AAAA must be the address Cloudflare should dial. Remove private or dead IPs. Wait for DNS TTL (and Cloudflare’s edge cache of the record).
3. Fix or drop broken AAAA — either serve working IPv6 end-to-end or delete the AAAA until you do.
4. Allow Cloudflare IP ranges on the origin — firewall / security group / edge ACL must accept CF’s published IPv4 and IPv6 ranges on 80/443 (or your Spectrum port).
5. Prefer Tunnel for private origins — run cloudflared outbound from the origin; point the hostname at the tunnel, not at a non-routable IP.
6. Check provider / BGP status — confirm the VPS is up, the floating IP is attached, and there is no regional routing incident between Cloudflare and your ASN.
7. Re-test orange-cloud — after DNS and allowlists settle, hit the site through Cloudflare again; compare Ray IDs and origin access logs.

# Quick origin listener + public IP sanity (on the server):
sudo ss -lntup 'sport = :443' 'sport = :80'
curl -4 -s https://ifconfig.me; echo
# Then from a laptop with grey-cloud or Host header to ORIGIN_IP as above.

Related

All Cloudflare error codes · Cloudflare Error 521 · Cloudflare Error 522 · Cloudflare Error 524 · Cloudflare Error 520 · Cloudflare Error 525 · Cloudflare Error 526 · 502 Bad Gateway · localhost refused to connect · ERR_NAME_NOT_RESOLVED · Anvil HTTP status · Wirebook: when sites get tired

Questions

Published 7 November 2026.