Error 522 Connection Timed Out

Question

Hi Team,

I have created two seprate zone in Rout53 for doman and subdomain.

1. **example.com**  -> created hosting zone in Route53
2. **subdomain.example.com**  -> created hosting zone in Route53
3. Added NS record of **subdomain.example.com **in hosting zone of **example.com**
4. Both website is working fine example.com and subdomain.example.com without SSL.
5. Y'day I have configured **Cloudflare** , after configured, only main domain (website) is working **example.com** fine but subdomain **subdomain.example.com** website getting an error **Error 522 Connection Timed Out. ** .  Both Ec2 Instance are working fine, and active mode.  Security group added to allow port 80, 443 in Ec2 instance.

I have spent 6 hours but not issue resolved. please help on the same.

Thanks & Reagards

Answer

Hello.

Looking at the CloudFlare documentation, it states that the cause is that the origin EC2 cannot be accessed properly.  
I think you need to check the difference in settings between the main domain and the subdomain.  
Also, if you access EC2 directly, do you agree that you can access normally?  
https://developers.cloudflare.com/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-5xx-errors/#error-522-connection-timed-out  
> * (Most common cause)  Cloudflare IP addresses are rate limited or blocked in .htaccess, iptables, or firewalls. Confirm your hosting provider allows Cloudflare IP addresses.
> * An overloaded or offline origin web server drops incoming requests.
> * Keepalives are disabled at the origin web server.
> * The origin IP address in your Cloudflare DNS app does not match the IP address currently provisioned to your origin web server by your hosting provider.
> * Packets were dropped at your origin web server.

Answer

Hi Team,

I have added all https://www.cloudflare.com/ips-v4 ips in secuirty group of dashboard Ec2 instance.

It was working without Cloudflare. but when added CloudFlare its not working.

I can access directly Ec2 insance using SSH key-pair value and alos i checked on browser  using that ip address with different port on browser directly, its displaying index nginx page. so its working there. 
But when I access using subdomain name then getting an error.

Regards

Answer

To confirm, https://example.com/ is all good? Browser connects to Cloudflare using SSL, then Cloudflare connects to nginx on EC2 (also using SSL?). This means that nginx is listening on the correct port (is this 443 ?) and is presenting a certificate that Cloudflare trusts.

https://subdomain.example.com/ is giving a 522 error, which means it's timing out when trying to contact nginx https://developers.cloudflare.com/support/troubleshooting/cloudflare-errors/troubleshooting-cloudflare-5xx-errors/#error-522-connection-timed-out

Check the port on which Cloudflare is trying to connect, and that nginx is listening on this port. If a host-based firewall is running (could be `iptables` or `firewalld` or `ufw`, etc.) then check it's allowing inbound traffic on that port. Check also that nginx is presenting a valid certificate.

Answer

Alos I added rule for all ips 0.0.0.0/0 but still getting same issue.

Error 522 Connection Timed Out

Relevant content