Cloudflare Error 523 (Origin Is Unreachable): Causes and How to Fix It
Cloudflare Error 523 (Origin Is Unreachable) is an HTTP 5xx status code returned by Cloudflare when its edge network is unable to establish contact with your origin web server. Unlike server software failures or application-level exceptions, Error 523 points to a routing breakdown: an intermediate network device or configuration between Cloudflare and the origin server lacks an active network route to the origin's IP address.
Technical references reviewed against current official Cloudflare documentation. Published by TechCorner HQ Editorial Desk. Learn how we review technical content.
Quick Summary: How to Resolve Error 523
- Verify Cloudflare DNS Records: Confirm that the A or AAAA records in your Cloudflare dashboard match your origin host's actual public IP address.
- Review Cloud VPC Route Tables (e.g., AWS): Ensure overly broad routes like
172.0.0.0/8are not misrouting Cloudflare's public IP range (172.64.0.0/13) toward a private subnet interface or internal gateway instead of an Internet Gateway. - Check Origin Accessibility: Send a direct request to your origin IP address to confirm your hosting provider or network edge is active and publicly routable.
- Gather MTR / Traceroute Diagnostics: If routing drops persist across the public Internet or host ISP, run an MTR from the origin server to the connecting Cloudflare IP to pinpoint where packets are dropped.
Comparing Error 523 and Error 522
Cloudflare returns several specific 5xx errors when proxy connections fail. Understanding how Error 523 differs from related codes helps isolate whether the issue is at the routing layer, transport layer, or application layer:
| Cloudflare Error Code | Status Description | Underlying Network Behavior |
|---|---|---|
| Error 523 | Origin Is Unreachable | No valid network route exists between Cloudflare and the destination origin IP address. |
| Error 522 | Connection Timed Out | The origin IP is routable, but the origin fails to complete the TCP three-way handshake before the connection times out. Learn more in our guide to Cloudflare Error 522. |
| Error 521 | Web Server Is Down | The origin IP is reachable and routable, but the origin web server actively refuses or resets TCP connections on the requested port. |
| Error 520 | Web Server Returns an Unknown Error | The origin accepted the connection, but returned an empty, malformed, or unexpected response header to Cloudflare. |
Common Causes of Cloudflare Error 523
- Incorrect DNS Origin IP: The domain's DNS records in Cloudflare point to an incorrect, expired, or unassigned IP address (frequently following a server migration or provider switch).
- AWS VPC Route Table Collisions: In Amazon Web Services (AWS) environments, an overly broad route entry such as
172.0.0.0/8captures traffic intended for Cloudflare's public subnet172.64.0.0/13and sends return packets to a private destination. - Internet Routing and BGP Failures: Upstream Autonomous Systems (ASNs), hosting providers, or intermediate Internet transit providers lack a viable route to announce or forward packets to the origin IP.
- Origin Ingress Filtering / Host Drops: Upstream host firewalls or edge routers drop packets before routing them to the destination host.
Step-by-Step Diagnostic and Resolution Steps
1. Audit Cloudflare DNS Records
An outdated IP address in your DNS records is the most common cause of Error 523. When Cloudflare proxies requests, it uses the origin IP defined in your DNS management interface.
Warning: Modifying DNS A or AAAA records changes live traffic destinations immediately. Verify the exact target IP address with your hosting provider before making modifications.
- Log in to the Cloudflare Dashboard and select your active zone.
- Navigate to DNS > Records.
- Locate the A record (for IPv4) or AAAA record (for IPv6) mapped to your root domain and critical subdomains.
- Compare the listed IP address against the public IP assigned by your origin hosting provider.
- If the values do not match, click Edit, enter the correct origin IP address, and click Save.
2. Fix AWS VPC Route Table Misconfigurations
Cloudflare utilizes public IP ranges that include 172.64.0.0/13. If your origin web server is hosted inside an AWS Virtual Private Cloud (VPC), a common configuration error is defining an overly broad internal route such as 172.0.0.0/8 that covers Cloudflare's public block and routes outbound responses to a private interface rather than the Internet.
- Open the AWS Management Console and go to the VPC service.
- Select Route tables from the left-hand navigation pane and choose the route table linked to your origin server's subnet.
- Inspect the Routes tab. Check whether a broad CIDR block (such as
172.0.0.0/8or172.16.0.0/12) directs outbound traffic to a local target, virtual private gateway, or VPC peering connection. - To resolve this collision, add a more specific route for
172.64.0.0/13with your Internet Gateway (IGW) or appropriate public NAT target as the destination. - Save the route table updates and test site access.
3. Test Direct Origin Connectivity
Verify whether your origin web server is reachable directly over the public Internet by bypassing Cloudflare's proxy layer. Execute a curl request using the origin's direct IP address while sending your domain name in the host header:
curl -Iv -H "Host: example.com" http://YOUR_ORIGIN_IP
If this command times out or returns a routing error from your local terminal or test machine, the origin server itself is offline, unreachable at the network perimeter, or experiencing upstream provider routing failures.
4. Collect Traceroute and MTR Diagnostics for Hosting Support
If your DNS records and VPC routes are correct but Error 523 persists, the routing fault likely resides upstream within intermediate Internet carriers or your hosting provider's network. Cloudflare requires specific diagnostic data to escalate routing issues to host administrators:
- Inspect your origin web server access logs to identify a recent connecting Cloudflare IP address that communicated with your server prior to the disruption. Official ranges can also be cross-referenced at Cloudflare IP Ranges.
- Log in to your origin server terminal and run an
mtrortraceroutefrom the origin server directly to that Cloudflare IP address:
mtr -rw YOUR_CONNECTING_CLOUDFLARE_IP
Share the resulting trace output, the specific request URL, and your origin IP with your hosting provider's network support team to locate and resolve the missing network route.
