Troubleshooting

Work through these in order:

1. Public side: DNS, TLS, WAF, and other proxied features.
2. Cloudflare to your private network: private network routing is on, and the route to the origin is in your default virtual network.
3. Your connectivity: tunnel or connector health, and routes.
4. Your network: routing, firewall rules, return path, and MSS clamp.

This error occurs when you proxy a private IP address and your account does not have the Private Origins entitlement. Contact your account team to enable it.

Check for other records on the same name.

Private network routing applies per name, not per record. If you have multiple A or AAAA records on the same name and at least one of them has private network routing enabled, all records on that name will use private network routing.

If traffic is not reaching your private origin:

1. Verify your connection is healthy: IPsec, GRE, or CNI tunnel health for Cloudflare WAN, tunnel status for Cloudflare Tunnel, or node status for Cloudflare Mesh.
2. Confirm the route to the origin is in your default virtual network.
3. Confirm the origin IP is routable within your private network.
4. Check that private_routing is set to true on the DNS record.
5. Verify the record has proxy status enabled.

Applies to Cloudflare WAN and Cloudflare Mesh. Check both:

• The Cloudflare source IP range is set to a private /12, not a public range.
• Your network has return routes that send the Cloudflare source ranges (100.64.0.0/12 or your configured /12, and 2606:4700:cf1:5000::/64) back through your Cloudflare connection.

Refer to Cloudflare source IP ranges.

On IPsec tunnels, the MSS clamp is missing or above 1360. Set the TCP MSS clamp on your tunnels to 1360 or lower.

Known issue with Tiered Cache when the origin is reached over Cloudflare WAN. As a workaround, create a Cache Rule that bypasses cache for the affected hostnames. Refer to Limitations.

The origin certificate does not match the hostname, or the private CA is not in the Custom Origin Trust Store. Verify the certificate served by the origin and the trust store configuration.

The account is on legacy routing. Request Unified Routing through your account team.

An asymmetric return path or a stateful firewall drop. Make sure return traffic goes back through the same connection Cloudflare used to reach the origin.

ICMP is blocked on the path or the health check is misconfigured. Allow ICMP between the tunnel endpoints and confirm the health check direction is bidirectional and type is reply.

The Use private network routing toggle is not turned on for the DNS record. Edit the record and turn the toggle on. Refer to Private network routing for dashboard and API steps.