Skip to content
Cloudflare Docs

Origin configuration

Origin configuration parameters determine how cloudflared proxies traffic to your origin server. You can configure these settings in the dashboard for remotely-managed tunnels, or add them to your configuration file for locally-managed tunnels.

TLS settings

originServerName

DefaultUI name
""Origin Server Name

Hostname that cloudflared should expect from your origin server certificate. If null, the expected hostname is the service URL, for example localhost if the service is https://localhost:443.

caPool

DefaultUI name
""Certificate Authority Pool

Local file path to the certificate authority (CA) for your origin server certificate (for example, /root/certs/ca.pem). The path should point to a certificate store file or a bundle file in .pem or .crt format that contains one or more trusted root CA certificates. You should only configure this setting if your certificate is not signed by Cloudflare.

noTLSVerify

DefaultUI name
falseNo TLS Verify

When false, TLS verification is performed on the certificate presented by your origin.

When true, TLS verification is disabled. This will allow any certificate from the origin to be accepted.

tlsTimeout

DefaultUI name
10sTLS Timeout

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

http2Origin

DefaultUI name
falseHTTP2 connection

When false, cloudflared will connect to your origin with HTTP/1.1.

When true, cloudflared will attempt to connect to your origin server using HTTP/2.0 instead of HTTP/1.1. HTTP/2.0 is a faster protocol for high traffic origins but requires you to deploy an SSL certificate on the origin. We recommend using this setting in conjunction with noTLSVerify so that you can use a self-signed certificate.

HTTP settings

httpHostHeader

DefaultUI name
""HTTP Host Header

Sets the HTTP Host header on requests sent to the local service.

disableChunkedEncoding

DefaultUI name
falseDisable Chunked Encoding

When false, cloudflared performs chunked transfer encoding when transferring data over HTTP/1.1.

When true, chunked transfer encoding is disabled. This is useful if you are running a Web Server Gateway Interface (WSGI) server.

Connection settings

connectTimeout

DefaultUI name
30sConnect Timeout

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

noHappyEyeballs

DefaultUI name
falseNo Happy Eyeballs

When false, cloudflared uses the Happy Eyeballs algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

When true, Happy Eyeballs is disabled.

proxyType

DefaultUI name
""Proxy Type

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are:

proxyAddress

DefaultUI name
127.0.0.1--

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen address for that proxy.

proxyPort

DefaultUI name
0--

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen.

keepAliveTimeout

DefaultUI name
1m30sIdle Connection Expiration Time

Timeout after which an idle keepalive connection can be discarded.

keepAliveConnections

DefaultUI name
100Keep Alive Connections

Default: 100

Maximum number of idle keepalive connections between Cloudflare and your origin. This does not restrict the total number of concurrent connections.

tcpKeepAlive

DefaultUI name
30sTCP Keep Alive Interval

Default: 30s

The timeout after which a TCP keepalive packet is sent on a connection between Cloudflare and the origin server.

Access settings

access

DefaultUI name
""Protect with Access

Requires cloudflared to validate the Cloudflare Access JWT prior to proxying traffic to your origin. You can enforce this check on public hostname routes that are protected by an Access application. For all L7 requests to these hostnames, Access will send the JWT to cloudflared as a Cf-Access-Jwt-Assertion request header.

To enable this security control in a configuration file, get the AUD tag for your Access application and add the following rule to originRequest:

access:
  required: true
  teamName: <your-team-name>
  audTag:
    - <Access-application-audience-tag>
    - <Optional-additional-tags>
Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal
Cookie Settings