guides/Cloudflare Proxy Problems

Understanding the Cloudflare Proxy

When a DNS record is "proxied" (orange cloud) in Cloudflare, traffic routes through Cloudflare's network before reaching your server. This adds CDN caching, DDoS protection, and hides your origin IP. However, it also means Cloudflare is a middleman that can sometimes cause issues.

Problem: ERR_TOO_MANY_REDIRECTS

Cause: Cloudflare SSL mode is set to "Flexible" while your server also forces HTTPS. This creates a redirect loop: Cloudflare connects to your server over HTTP → server redirects to HTTPS → Cloudflare receives redirect → connects over HTTP again.

Fix: Change SSL/TLS mode to "Full" or "Full (Strict)" in Cloudflare Dashboard → SSL/TLS. If your server doesn't have SSL, either install one (use Let's Encrypt) or turn off the HTTP-to-HTTPS redirect on your server.

Problem: Email Not Working After Enabling Proxy

Cause: Cloudflare proxying only works for web traffic (HTTP/HTTPS). SMTP (email) traffic cannot be proxied. If your MX records or mail subdomain records are proxied, email delivery will fail.

Fix: Set MX records and any mail-related A records (e.g., mail.yourdomain.com) to DNS Only (grey cloud).

⚠ Warning: Never proxy MX records or mail server A records through Cloudflare. Email uses SMTP on port 25, which Cloudflare's proxy does not support.

Problem: WebSocket Connections Failing

Cause: Cloudflare proxying supports WebSockets, but it's disabled by default on some plans or misconfigured.

Fix: In Cloudflare Dashboard → Network → enable "WebSockets". Also ensure your server is sending the correct Upgrade: websocket headers.

NGINX WebSocket proxy config

location /ws {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Host $host;
}

Problem: Origin IP Exposed Despite Proxy

If your origin IP leaks through other means, Cloudflare's protection is less effective. Common leak sources:

▸Direct A records that aren't proxied (e.g., FTP subdomain)
▸Email headers revealing the origin IP
▸Old DNS records that bypass Cloudflare
▸Certificate transparency logs showing your origin IP

💡 Tip: Use Cloudflare's "Always Use HTTPS" and "Automatic HTTPS Rewrites" under SSL/TLS settings to ensure all traffic goes through the proxy.

Problem: Caching Too Aggressively

Cloudflare may cache responses you don't want cached (like API responses or dynamic pages).

Disable caching for specific paths via Page Rules

# Cloudflare Page Rule to bypass cache:
URL pattern: yourdomain.com/api/*
Setting: Cache Level = Bypass

# Or via Cache-Control header from your server:
Cache-Control: no-store, no-cache, must-revalidate

Problem: Real Visitor IP Shows as Cloudflare IP

When proxied, your server sees Cloudflare's IP, not the visitor's. The real IP is in the CF-Connecting-IP header.

Get real IP in NGINX

# In your NGINX config, before the server block:
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
# (Add all Cloudflare IP ranges from cloudflare.com/ips)
real_ip_header CF-Connecting-IP;

SSL Certificate Issues

Fix HTTPS problems

Connect to Cloudflare

Set up Cloudflare correctly from the start

DNS Not Resolving

General DNS troubleshooting

Cloudflare Proxy Problems — Fix Guide