Fix: Cloudflare 522 Connection Timed Out to Origin

!Symptoms

• Users seeing Cloudflare 522 error page
• Origin server appears to be running but Cloudflare can't reach it
• Error happens intermittently or after traffic spikes
• Direct access to origin IP works but through Cloudflare it doesn't

?Root Causes

• Origin server firewall blocking Cloudflare IP ranges
• Origin server overloaded and not accepting new connections
• Keep-alive timeout on origin shorter than Cloudflare's (100s)
• Origin server TCP backlog full — SYN queue overflowing
• Network path between Cloudflare and origin has high latency or packet loss

#Diagnosis Steps

1. 1Check if origin responds directly: `curl -I http://<origin-ip>`
2. 2Check Cloudflare Ray ID in the error page for debugging
3. 3Check origin server connection limits: `ss -s` for connection summary
4. 4Check if Cloudflare IPs are whitelisted: `iptables -L | grep -i cloudflare`
5. 5Check Cloudflare Analytics → Overview → Error codes for patterns

>Fix

1. 1Whitelist all Cloudflare IPs: https://www.cloudflare.com/ips/ in your firewall
2. 2Increase origin's keep-alive timeout to >100 seconds
3. 3Increase TCP backlog: `sysctl -w net.core.somaxconn=65535`
4. 4Scale origin server or add more capacity behind a load balancer
5. 5Enable Cloudflare Load Balancing to failover to backup origins

*Prevention

• Always whitelist Cloudflare IPs and restrict origin to only accept Cloudflare traffic
• Monitor origin response time and alert before it hits Cloudflare's timeout (100s)
• Use Cloudflare Argo Smart Routing for better path optimization
• Set up Cloudflare Health Checks to detect origin failures early
• Load test origin to know capacity limits before traffic spikes

Related Error Messages