• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

I don't know were to begin... Cloudflare and the dreaded 522 error

Scheduled Pinned Locked Moved General pfSense Questions
16 Posts 5 Posters 1.9k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    swemattias
    last edited by Aug 6, 2022, 5:18 PM

    Since I have redone my internal network and changed my domain for most of my services I get an 522 error. All my domains are proxied on Cloudflare, I use Traefik as reverse proxy (that is up and running).
    522 means that Cloudflare cant reach the server on my inside. I have googled myself blind.
    So far I have made these rules on the WAN Side:
    donesofar.png
    Yes I am walking blind here, trying to solve this.
    It is totally ok to tell me to go to Traefik or Cloudflare.
    But for some reason it feels like a pfSense issue, I changed from a simple config to utilizing the switch in my SG2100.
    The same LAN is sent out on all ports.
    As I said I don't know where to begin to trying to nail this.
    I had it working before the remodelling.

    J C 2 Replies Last reply Aug 6, 2022, 5:25 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @swemattias
      last edited by Aug 6, 2022, 5:25 PM

      @swemattias none of those rules show any hits on them see the 0/0 that means the rule has never even been evaluated by any matching traffic.

      Not sure how anything from the web would have a destination of your lan address. The destination of any traffic coming from the internet would be your wan address.

      The firewall rule would be there to allow that after the port forward that sent it there.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • C
        Cool_Corona @swemattias
        last edited by Aug 6, 2022, 5:25 PM

        @swemattias Move the from address (cloudflare) down to the portforwards to your internal server.

        Delete the top rule afterwards.

        1 Reply Last reply Reply Quote 0
        • S
          swemattias
          last edited by swemattias Aug 6, 2022, 6:08 PM Aug 6, 2022, 6:05 PM

          @johnpoz and @Cool_Corona
          Yes the rules has a 0/0 hit ratio, that is not good. But all I have read about the 522 says that the incoming traffic can't reach the internal server.

          new.png

          New rules. Still 0/0. I have read so much looked at so many YTs that I have gone blind it feels like.
          I have setup so that pfSense sends the real ip to the service, so that is correct.

          I now also added a rule to LAN to accept traffic from WAN, just because.

          V J 2 Replies Last reply Aug 6, 2022, 6:15 PM Reply Quote 0
          • V
            viragomann @swemattias
            last edited by Aug 6, 2022, 6:15 PM

            @swemattias said in I don't know were to begin... Cloudflare and the dreaded 522 error:

            Yes the rules has a 0/0 hit ratio, that is not good. But all I have read about the 522 says that the incoming traffic can't reach the internal server.

            Possibly it can neither reach pfSense.

            Sniff the traffic on the WAN to check it out.

            S 2 Replies Last reply Aug 6, 2022, 6:20 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @swemattias
              last edited by Aug 6, 2022, 6:15 PM

              @swemattias that rule is wan net, the source is not your wan net - its going to be anything on the internet, wan net is just that the network your wan is attached too.

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • S
                swemattias @viragomann
                last edited by swemattias Aug 6, 2022, 6:21 PM Aug 6, 2022, 6:20 PM

                @johnpoz Of course... that setting I picked up somewhere.
                Like this?

                next1.png

                I still get an 522 btw.

                J 1 Reply Last reply Aug 6, 2022, 6:26 PM Reply Quote 0
                • S
                  swemattias @viragomann
                  last edited by Aug 6, 2022, 6:22 PM

                  @viragomann Any tips how to best do that? Something lurking inside pfSense?

                  V 1 Reply Last reply Aug 6, 2022, 6:25 PM Reply Quote 0
                  • V
                    viragomann @swemattias
                    last edited by Aug 6, 2022, 6:25 PM

                    @swemattias
                    Diagnostic > Packet Capture

                    Select WAN at interface. At port enter "80|443". Hit Start.
                    Trigger some packets by trying to access your web server from the internet. Stop the capture and check the result if you see any packet.

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator @swemattias
                      last edited by johnpoz Aug 6, 2022, 6:29 PM Aug 6, 2022, 6:26 PM

                      @swemattias are you actually creating a port forward, creating wan rules with destination of your lan side IP is not going to work without a port forward.

                      Again that rule is not have any evaluations 0/0

                      To sniff on your wan, under diagnostics packet capture.. Should be simple enough to just go to can you see me .org and try port 443 for example while you do the packet capture.

                      Do you have floating rules? Lets see your port forwards..

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      S 1 Reply Last reply Aug 6, 2022, 6:39 PM Reply Quote 0
                      • S
                        swemattias @johnpoz
                        last edited by swemattias Aug 6, 2022, 6:44 PM Aug 6, 2022, 6:39 PM

                        @johnpoz I has only opened the port like I have done so many times before. But I did create an Port Forward under NAT now.
                        It is a, a translated Swedish saying, fall forward. I don't get an 522 but still an time out....

                        In the packet sniffing I do see this from time to time:

                        20:34:15.581150 IP my.external.ip.12483 > 108.157.214.15.443: tcp 0
                        20:34:15.581483 IP my.external.ip.12483 > 108.157.214.15.443: tcp 517
                        

                        Here are the whole packet sniff result.
                        Sniffing result

                        I am not used or have any valuable knowledge looking at packet sniffing results...

                        V J 2 Replies Last reply Aug 6, 2022, 6:48 PM Reply Quote 0
                        • V
                          viragomann @swemattias
                          last edited by Aug 6, 2022, 6:48 PM

                          @swemattias said in I don't know were to begin... Cloudflare and the dreaded 522 error:

                          In the packet sniffing I do see this from time to time:
                          20:34:15.581150 IP my.external.ip.12483 > 108.157.214.15.443: tcp 0
                          20:34:15.581483 IP my.external.ip.12483 > 108.157.214.15.443: tcp 517

                          This might be outbound connections.

                          But obviously nothing hits my.external.ip.443. So you should look in front of your pfSense for the failure.
                          Maybe there is something wrong on Cloudflare.

                          1 Reply Last reply Reply Quote 0
                          • S
                            swemattias
                            last edited by Aug 6, 2022, 6:51 PM

                            I did redid my Port forwards under NAT, to divide them into 80 and 443 so they are more clear.
                            And suddenly it all started to work.

                            yay.png

                            Thank you for helping me, means more to me than you will ever know.

                            So thank you @johnpoz @Cool_Corona and @viragomann ♥

                            1 Reply Last reply Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @swemattias
                              last edited by Aug 6, 2022, 7:01 PM

                              @swemattias said in I don't know were to begin... Cloudflare and the dreaded 522 error:

                              only opened the port like I have done so many times before

                              I don't know what you were doing before - maybe you had haproxy listening on your wan before, then no you wouldn't need a port forward.

                              If you want traffic to hit your public IP on wan, and get sent to some rfc1918 address behind you have to do a port forward. Unless your using haproxy as a reverse proxy to have that do that for you.

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              S 1 Reply Last reply Aug 10, 2022, 9:05 AM Reply Quote 0
                              • S
                                swemattias @johnpoz
                                last edited by Aug 10, 2022, 9:05 AM

                                @johnpoz I ditched HAProxy and went to Traefik and all is working now. :)

                                1 Reply Last reply Reply Quote 0
                                • 0
                                  0scale
                                  last edited by Aug 10, 2022, 1:48 PM

                                  This post is deleted!
                                  1 Reply Last reply Reply Quote 0
                                  16 out of 16
                                  • First post
                                    16/16
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                    This community forum collects and processes your personal information.
                                    consent.not_received