Cloudflare 522 Connection Timed Out: Origin Port and Allowlist When the Orange Cloud Hangs

Cloudflare · Techclick CLI troubleshooting lab

Site on orange-cloud returns 522. Origin curl from your laptop works. Customers see an error page.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cloudflare for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

522 means Cloudflare could not TCP to origin. Origin firewall must allow Cloudflare IP ranges, and the origin port must match.

Why this ticket shows up

Your laptop is not a Cloudflare edge. Allowing only your home IP makes you think the origin is fine.

Symptoms operators actually see

• 522

• Origin up from admin IP

• Origin NSG/iptables not allowing Cloudflare

• Wrong origin port 443 vs 8443

CLI first — copy this block

Run these on the Cloudflare device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

curl -I --resolve example.com:443:<origin-ip> https://example.com
ss -lntp | grep 443
nft list ruleset | grep 443
# on the origin, last packets:
tcpdump -nni any port 443 and not host <your-ip>

How to read that output

If tcpdump never shows Cloudflare edges, the path or the ACL is dropping them. Laptop success is irrelevant.

Triage order

1. Confirm origin listens on the proxied port

2. Allow Cloudflare published IP ranges

3. Disable 'I'm under attack' only if it is a false 5xx storm

4. Check origin certificate if it is 526 not 522

5. Retest via the orange cloud

Classic traps

What you see	Real cause	Fix
Grey-cloud forever	You lose WAF	Fix origin allowlist
Allow 0.0.0.0/0 on the VM	Use Cloudflare ranges	Tighter
Restart nginx only	SYN never arrived	Watch tcpdump

Proof the ticket is closed

• Orange-cloud 200

• tcpdump shows Cloudflare edges

• Laptop still works

Say this in an interview

522 is origin TCP from Cloudflare, not from me. I allow their ranges before I debug the app.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/