Origin configuration

Origin configuration parameters determine how cloudflared proxies traffic to your origin server. You can configure these settings in the dashboard for remotely-managed tunnels, or add them to your configuration file for locally-managed tunnels.

TLS settings

originServerName

Default	UI name
""	Origin Server Name

Hostname that cloudflared should expect from your origin server certificate. If null, the expected hostname is the service URL, for example localhost if the service is https://localhost:443.

caPool

Default	UI name
""	Certificate Authority Pool

Path to the certificate authority (CA) for the certificate of your origin. This option should be used only if your certificate is not signed by Cloudflare.

noTLSVerify

Default	UI name
false	No TLS Verify

When false, TLS verification is performed on the certificate presented by your origin.

When true, TLS verification is disabled. This will allow any certificate from the origin to be accepted.

tlsTimeout

Default	UI name
10s	TLS Timeout

Timeout for completing a TLS handshake to your origin server, if you have chosen to connect Tunnel to an HTTPS server.

http2Origin

Default	UI name
false	HTTP2 connection

When false, cloudflared will connect to your origin with HTTP/1.1.

When true, cloudflared will attempt to connect to your origin server using HTTP/2.0 instead of HTTP/1.1. HTTP/2.0 is a faster protocol for high traffic origins but requires you to deploy an SSL certificate on the origin. We recommend using this setting in conjunction with noTLSVerify so that you can use a self-signed certificate.

HTTP settings

httpHostHeader

Default	UI name
""	HTTP Host Header

Sets the HTTP Host header on requests sent to the local service.

disableChunkedEncoding

Default	UI name
false	Disable Chunked Encoding

When false, cloudflared performs chunked transfer encoding when transferring data over HTTP/1.1.

When true, chunked transfer encoding is disabled. This is useful if you are running a Web Server Gateway Interface (WSGI) server.

Connection settings

connectTimeout

Default	UI name
30s	Connect Timeout

Timeout for establishing a new TCP connection to your origin server. This excludes the time taken to establish TLS, which is controlled by tlsTimeout.

noHappyEyeballs

Default	UI name
false	No Happy Eyeballs

When false, cloudflared uses the Happy Eyeballs algorithm for IPv4/IPv6 fallback if your local network has misconfigured one of the protocols.

When true, Happy Eyeballs is disabled.

proxyType

Default	UI name
""	Proxy Type

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures what type of proxy will be started. Valid options are:

• "" for the regular proxy
• "socks" for a SOCKS5 proxy. Refer to the tutorial on connecting through Cloudflare Access using kubectl for more information.

proxyAddress

Note

For locally-managed tunnels only.

Default	UI name
127.0.0.1	—

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen address for that proxy.

proxyPort

Note

For locally-managed tunnels only.

Default	UI name
0	—

cloudflared starts a proxy server to translate HTTP traffic into TCP when proxying, for example, SSH or RDP. This configures the listen port for that proxy. If set to zero, an unused port will randomly be chosen.

keepAliveTimeout

Default	UI name
1m30s	Idle Connection Expiration Time

Timeout after which an idle keepalive connection can be discarded.

keepAliveConnections

Default	UI name
100	Keep Alive Connections

Default: 100

Maximum number of idle keepalive connections between Cloudflare and your origin. This does not restrict the total number of concurrent connections.

tcpKeepAlive

Default	UI name
30s	TCP Keep Alive Interval

Default: 30s

The timeout after which a TCP keepalive packet is sent on a connection between Cloudflare and the origin server.

Access settings

access

Default	UI name
""	Protect with Access

Requires cloudflared to validate the Cloudflare Access JWT prior to proxying traffic to your origin. You can enforce this check on public hostname routes that are protected by an Access application. For all L7 requests to these hostnames, Access will send the JWT to cloudflared as a Cf-Access-Jwt-Assertion request header.

To enable this security control in a configuration file, get the AUD tag for your Access application and add the following rule to originRequest:

access:
  required: true
  teamName: <your-team-name>
  audTag:
    - aud1 <Access-application-audience-tag>
    - aud2 <Optional-additional-tags>