Origin configuration
Origin configuration parameters determine how cloudflared proxies traffic to your origin server. You can configure these settings in the dashboard for remotely-managed tunnels, or add them to your configuration file for locally-managed tunnels.
TLS settings
originServerName
| Default | UI name |
|---|---|
"" | Origin Server Name |
Hostname that cloudflared should expect from your origin server certificate. If null, the expected hostname is the service URL, for example localhost if the service is https://localhost:443.
caPool
| Default | UI name |
|---|---|
"" | Certificate Authority Pool |
Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.
noTLSVerify
| Default | UI name |
|---|---|
false | No TLS Verify |
When false, TLS verification is performed on the certificate presented by your origin.
When true, TLS verification is disabled. This will allow any certificate from the origin to be accepted.
tlsTimeout
| Default | UI name |
|---|---|
10s | TLS Timeout |
Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.
http2Origin
| Default | UI name |
|---|---|
false | HTTP2 connection |
When false, cloudflared will connect to your origin with HTTP/1.1.
When true, cloudflared will attempt to connect to your origin server using HTTP/2.0 instead of HTTP/1.1. HTTP/2.0 is a faster protocol for high traffic origins but requires you to deploy an SSL certificate on the origin. We recommend using this setting in conjunction with noTLSVerify so that you can use a self-signed certificate.
HTTP settings
httpHostHeader
| Default | UI name |
|---|---|
"" | HTTP Host Header |
Sets the HTTP Host header on requests sent to the local service.
disableChunkedEncoding
| Default | UI name |
|---|---|
false | Disable Chunked Encoding |
When false, cloudflared performs chunked transfer encoding when transferring data over HTTP/1.1.
When true, chunked transfer encoding is disabled. This is useful if you are running a Web Server Gateway Interface (WSGI) server.
Connection settings
connectTimeout
| Default | UI name |
|---|---|
30s | Connect Timeout |
Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.
noHappyEyeballs
| Default | UI name |
|---|---|
false | No Happy Eyeballs |
When false, cloudflared uses the Happy Eyeballs algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.
When true, Happy Eyeballs is disabled.
proxyType
| Default | UI name |
|---|---|
"" | Proxy Type |
cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP.
This configures what type of proxy will be started. Valid options are:
""for the regular proxy"socks"for a SOCKS5 proxy. Refer to the tutorial on connecting through Cloudflare Access using kubectl for more information.
proxyAddress
| Default | UI name |
|---|---|
127.0.0.1 | — |
cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP.
This configures the listen address for that proxy.
proxyPort
| Default | UI name |
|---|---|
0 | — |
cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP.
This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen.
keepAliveTimeout
| Default | UI name |
|---|---|
1m30s | Idle Connection Expiration Time |
Timeout after which an idle keepalive connection can be discarded.
keepAliveConnections
| Default | UI name |
|---|---|
100 | Keep Alive Connections |
Default: 100
Maximum number of idle keepalive connections between Cloudflare and your origin. This does not restrict the total number of concurrent connections.
tcpKeepAlive
| Default | UI name |
|---|---|
30s | TCP Keep Alive Interval |
Default: 30s
The timeout after which a TCP keepalive packet is sent on a connection between Cloudflare and the origin server.
Access settings
access
| Default | UI name |
|---|---|
"" | Protect with Access |
Requires cloudflared to validate the Cloudflare Access JWT prior to proxying traffic to your origin. You can enforce this check on public hostname routes that are protected by an Access application. For all L7 requests to these hostnames, Access will send the JWT to cloudflared as a Cf-Access-Jwt-Assertion request header.
To enable this security control in a configuration file, get the AUD tag for your Access application and add the following rule to originRequest:
access: required: true teamName: <your-team-name> audTag: - aud1 <Access-application-audience-tag> - aud2 <Optional-additional-tags>