Origin Rule Limited to 8080 and 80

Hello! I have an origin rule that is pointing to my backend server that is listening on port 8080 and 80. However, if I try any other ports, it just refuses to connect. How do I allow more ports? It's a python backend (flask web app on Ubuntu Linux) if that matters.

Thanks!

SomeoneOP•4/19/25, 3:07 AM

I'm basically using the Origin Rule as a reverse proxy from a IPv4 numeric IP to a simple api domain name

SomeoneOP•4/19/25, 3:08 AM

I know it's possible to allow more ports, another machine of mine has no issues, but I can't remember what I did or if I did anything at all, so I would love a bit of help so I can document it for future reference

SSomeone Hello! I have an origin rule that is pointing to my backend server that is liste...

Laudian•4/19/25, 8:50 AM

There's no such limitation. How exactly did you try to connect?

LLaudian There's no such limitation. How exactly did you try to connect?

SomeoneOP•4/19/25, 8:57 AM

Using any port besides 8080 or 80 doesn't work

SomeoneOP•4/19/25, 8:57 AM

I've tried literally everything, all other ports are accessible on any computer through the http://129.123.153.13:XXXX IP, just not when I do an origin rule

SomeoneOP•4/19/25, 9:01 AM

ufw on the linux machine is disabled too, all ports should be accessible

SomeoneOP•4/20/25, 12:25 AM

bump - would anyone know what else to try?

SomeoneOP•4/20/25, 1:52 AM

@Chaika I think you helped me with something kinda similar many months ago, I highly apologize for pinging, but it's slightly urgent (for a final project due tomorrow hahaha)

SSomeone Using any port besides 8080 or 80 doesn't work

Chaika•4/20/25, 3:15 AM

using any port other then 8080/80 when connecting to cf?
Eitherway if your origin is insecure/http, your best bet is just to deploy a Cloudflare tunnel on it, making everything secure and just work

CChaika using any port other then 8080/80 when connecting to cf? Eitherway if your origi...

SomeoneOP•4/20/25, 3:17 AM

When I setup an origin rule on let's say 25578, it fails to connect through the domain name (error 522)

SomeoneOP•4/20/25, 3:17 AM

I'm hesitant on doing a tunnel because other classes will be using this machine and I'm unsure if it'll mess with them

SSomeone When I setup an origin rule on let's say 25578, it fails to connect through the ...

Chaika•4/20/25, 3:23 AM

Your origin is insecure/only http?

CChaika Your origin is insecure/only http?

SomeoneOP•4/20/25, 3:24 AM

how would I tell?

SomeoneOP•4/20/25, 3:24 AM

i'm very new to most of this hahaha

Chaika•4/20/25, 3:24 AM

if you didn't setup any certificates for it

Chaika•4/20/25, 3:25 AM

do you have the origin rule active right now, to force to 25578?

SomeoneOP•4/20/25, 3:25 AM

then it's probably insecure, i can set up some

SomeoneOP•4/20/25, 3:25 AM

no, I don't have the origin rule for 25578 right now, that was just an example

SomeoneOP•4/20/25, 3:25 AM

I can get a python web server running and test it though

SomeoneOP•4/20/25, 3:28 AM

done

SSomeone done

Chaika•4/20/25, 3:29 AM

wildcard isn't going to match, switch to equals

SomeoneOP•4/20/25, 3:29 AM

https://sssapi.ticketsx.xyz unaccessible here, but accessible at http://129.123.153.13:25578

SomeoneOP•4/20/25, 3:29 AM

done

SSomeone https://sssapi.ticketsx.xyz unaccessible here, but accessible at http://129.123....

Chaika•4/20/25, 3:30 AM

http://129.123.153.13:25578/
This isn't accessible externally

SomeoneOP•4/20/25, 3:31 AM

oh yeah it's not working right now erm

Chaika•4/20/25, 3:31 AM

worth noting in some setups, it may work on the external address when you're inside of the network due to hairpinning, but not work truly external

SomeoneOP•4/20/25, 3:31 AM

that's fair

SomeoneOP•4/20/25, 3:31 AM

let me check my router settings stuff

Chaika•4/20/25, 3:32 AM

Tunnels get rid of all this silliness with port forwarding and such

SomeoneOP•4/20/25, 3:32 AM

oh weird yeah, it is only accessible through the university vpn

SomeoneOP•4/20/25, 3:32 AM

hmmm

Chaika•4/20/25, 3:33 AM

yea, big difference between
inside network request -> hits first router which knows its handling the subnet -> gets turned around (hairpinning)
External request -> hits router from outside (firewall, port forwarding, could be double nat/behind two routers, etc)

SomeoneOP•4/20/25, 3:34 AM

gonna quickly reboot the machine and see if the changes i did to the router stuff worked

SomeoneOP•4/20/25, 3:34 AM

if not, then i might need some help setting up a tunnel haha

Chaika•4/20/25, 3:34 AM

Tunnels are super easy, espec if on linux

SomeoneOP•4/20/25, 3:35 AM

yeah it is

CChaika Tunnels are super easy, espec if on linux

SomeoneOP•4/20/25, 3:38 AM

weird, okay yeah i'll need help setting up the tunnel

SomeoneOP•4/20/25, 3:39 AM

literally everything is enabled through the university router settings portal thing

SomeoneOP•4/20/25, 3:39 AM

might have to contact IT on Monday and see what's up lol

SSomeone weird, okay yeah i'll need help setting up the tunnel

Chaika•4/20/25, 3:40 AM

Sure, this is all within the Zero trust dashboard (left option when account level)
There's a decent guide for getting the base tunnel setup here first: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/get-started/create-remote-tunnel/
Once you have it installed, you'll want to make a public hostname with the service url of http://129.123.153.13:25578/http://129.123.153.13:25578/
If there's anything in specific that confuses you feel free to ask, otherwise it's pretty simple

Cloudflare Docs

Create a tunnel (dashboard) · Cloudflare Zero Trust docs

Follow this step-by-step guide to create your first remotely-managed tunnel using Zero Trust.

CChaika Sure, this is all within the Zero trust dashboard (left option when account leve...

SomeoneOP•4/20/25, 3:43 AM

Is there a way to have basically all ports exposed so I don't have to create multiple public hostnames?

SSomeone Is there a way to have basically all ports exposed so I don't have to create mul...

Chaika•4/20/25, 3:44 AM

no, public hostnames are basically per service/dest port

Chaika•4/20/25, 3:45 AM

Fundementally Cloudflare's cdn/proxy only has a handful of https ports (443, 2053, 2083, 2087, 2096, 8443), you could never directly expose sssapi.ticketsx.xyz:25578 with proxy enabled
Tunnels make it so https://sssapi.ticketsx.xyz (if not port specified https defaults to 443) -> tunnel -> locally requests 25578

SomeoneOP•4/20/25, 3:46 AM

SomeoneOP•4/20/25, 3:46 AM

is that right?

Chaika•4/20/25, 3:46 AM

Is your service locally (on vpn) reachable via http://129.123.153.13:80/http://129.123.153.13:80/?

SomeoneOP•4/20/25, 3:46 AM

yep

Chaika•4/20/25, 3:47 AM

then yea, that looks right

SomeoneOP•4/20/25, 3:47 AM

does it sometimes take a minute to work?

SomeoneOP•4/20/25, 3:47 AM

https://ssapi.ticketsx.xyz/ doesn't seem to be working quite yet

Origin Rule Limited to 8080 and 80

Similar Threads

Similar Threads

Similar Threads