Tunnel Doctor
cloudflared Connection Refused Troubleshooter
Find listening-address, port and container-network mistakes.
What this usually means
Connection refused usually means the target address was reachable enough to reject the TCP connection, but no service accepted it on the requested address and port.
What it does not mean
It is not the same as a timeout. A timeout gives no timely response, while an active refusal usually points first to the listener, address family, port or network namespace.
Typical redacted log
dial tcp [REDACTED_IP]:8080: connect: connection refused
Check in this order
These are baseline command examples. For Windows Service or Kubernetes, open the analyzer and select the actual environment to get platform-native commands.
nc -vz -w 3 <origin-host> <origin-port>curl -v --connect-timeout 5 <origin-url>ss -tlnp | grep ':<origin-port> 'Common false diagnoses
- Treating every refusal as a firewall drop.
- Checking only whether the process exists instead of whether it listens on the expected address and port.
- Ignoring an IPv6 ::1 versus IPv4 127.0.0.1 listener mismatch.
How to verify recovery
- A TCP probe to the exact address and port succeeds from cloudflared's environment.
- The process is listening on the intended interface/address family.
- New requests no longer contain connection-refused evidence.
Still unsure?
Paste the relevant cloudflared log into the local analyzer. Redaction is on by default and the log is not uploaded to a TRACER RECART backend.
Open analyzer