Cloudflare Error 522: Connection timed out

Identify: does your log match?

HTTP/2 522
server: cloudflare
cf-ray: 8d2f51c09a7b3e22-IAD
content-type: text/html; charset=UTF-8

Error 522 Ray ID: 8d2f51c09a7b3e22 • 2026-10-20 14:02:51 UTC
Connection timed out
You   Browser  Working
      Ashburn  Cloudflare  Working
www.example.com  Host  Error

1. High

   Firewall drops Cloudflare IPs

   iptables, ufw, a security group or fail2ban drops SYN packets from Cloudflare ranges. No RST is sent, so the connect times out.

2. Medium

   DNS points to the wrong origin IP

   The proxied A record still points at an old server or a private IP that Cloudflare cannot route to.

3. Medium

   Origin overloaded or bound to localhost

   The backlog is full, or the app listens on 127.0.0.1 only, so external connections never complete.

Fix

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw enable

for ip in $(curl -s https://www.cloudflare.com/ips-v4) $(curl -s https://www.cloudflare.com/ips-v6); do
  sudo ufw allow proto tcp from "$ip" to any port 443
  sudo ufw allow proto tcp from "$ip" to any port 80
done
sudo ufw reload

Verify: reproduce it on purpose

$ curl -sv --connect-timeout 20 --resolve www.example.com:443:203.0.113.10 https://www.example.com/ -o /dev/null

Prevent

• Monitor the origin directly, bypassing Cloudflare.
• Use Cloudflare Tunnel to avoid exposing origin ports.
• Alert on 522 rate in Cloudflare Analytics.