Troubleshoot proxies and join addresses

This page covers what goes wrong once a web proxy, a join address, a custom domain or an external server is running. The messages that a form shows while you create or change one are in the troubleshooting section of that task's own page.

When the edge cannot get an answer from your origin, visitors get an error page: 502 when the connection fails, and 504 when the origin does not answer within the origin timeout. The page names the failure, such as Connection refused, and shows a ray ID to quote when you contact support. The Coritan-Error response header carries the failure's code, such as connect_refused, and the Coritan-Ray header carries the ray ID.

A client that asks for JSON, or requests a path that starts with /api/, gets the same facts as JSON instead of the page:

{
  "error": "Bad Gateway",
  "status": 502,
  "reason": "connect_refused",
  "reason_label": "Connection refused",
  "message": "The origin server actively refused the connection.",
  "domain": "www.example.com",
  "ray_id": "8f3a1c2b9d4e5f60"
}

The answer also carries hint, edge and timestamp. To see each origin that the edge tried and how each attempt ended, turn on development mode (Use development mode while you debug). The failures are:

No origin configured (no_backends_configured)

The web proxy has no origin to forward to. Set the Origin host and Port on the Origin tab (Change a web proxy's origin).

All origins marked down (all_origins_unhealthy)

Every origin failed several times in a row, so the edge skips them for a short time and then tries them again. The failure named on the earlier error pages, or development mode's list of attempts, says which of the causes below applies.

Connection refused (connect_refused)

Nothing listens on the origin's address and port, or a firewall refuses the connection. Check that the site's server is running, and that the Port on the Origin tab is the port it listens on.

Connect timed out (connect_timeout)

The origin did not accept the connection in time. A host that is down, or a firewall that drops connections from the internet, looks like this. Check that the host is up, and that its firewall accepts connections to the port from the internet.

Origin unreachable (connect_unreachable)

The edge has no network path to the origin's address. Check the address in Origin host.

Origin DNS failed (connect_dns)

The Origin host is a hostname, and it did not resolve when the edge looked it up. Check the name's records at its DNS provider, or enter the origin's IP address.

Origin TLS failed (connect_tls)

Connect to the origin over TLS is on, and the edge refused the origin's certificate or TLS version, or the port does not serve HTTPS. Give the origin a certificate for the origin host from a public certificate authority, or turn TLS off and use the origin's plain HTTP port (Origins).

Connect failed (connect_failed)

The edge could not open a connection for another reason. Check that the origin is online, and that its address and port are right.

Closed before replying (origin_closed_early)

The origin accepted the connection, then closed it without an answer. Something on the port does not speak HTTP, or the site's application stopped in the middle of the request. Check the origin's own logs for the time on the error page.

Connection reset (origin_reset)

The origin dropped the connection while the request was in progress. A restart, a process that ran out of memory, or another proxy in front of the application looks like this. Check the origin's logs.

Response timed out (read_timeout)

The origin accepted the request, but did not finish its answer within the origin timeout, which is 60 seconds unless you changed it. This is the failure that answers 504. Look for a slow page or a slow database query, or raise Origin timeout (s) on the Origin tab, up to 120 seconds.

WebSocket refused (ws_rejected)

The origin answered a WebSocket request with something other than 101. Check that the path accepts WebSocket connections.

Edge error (proxy_error)

The request failed inside Coritan's edge, and nothing on your side causes it. Contact support with the ray ID.

When every request fails just after you change the origin, check PROXY protocol to origin first. An origin that does not expect the header fails every request, so turn the switch off, or set the origin's web server to accept PROXY protocol version 2 (Change a web proxy's origin).

The edge serves the name's own certificate once it is active. Until then, the edge answers HTTPS with a certificate for another name, and browsers warn visitors. The Certificate card on the web proxy's Overview tab shows where the certificate stands.

The card shows Issuance in progress

The certificate authority is still checking the name. Reload the page in a few minutes.

The card shows The last issuance failed

The authority could not validate the name, and the card gives its reason. The name must resolve to the edge, or be in a DNS zone that Coritan hosts. Fix that, then select Request certificate (Request or renew the certificate).

The web proxy has no certificate

Request a certificate automatically was off when you created it. Select Request certificate on the card.

A certificate covers one name, so example.com and www.example.com each need their own (Visitors see a certificate warning).

The edge answers 404 with this page when the name reaches it but has no active web proxy.

No web proxy has the exact name

example.com and www.example.com are separate names, and each needs its own web proxy. Create one for the name that visitors type (Create a web proxy).

The web proxy is new

The edge can go on answering 404 for a few seconds after you create a web proxy. Reload the page.

You deleted the web proxy

A proxied DNS record still sends visitors to the edge. Create a web proxy for the name, or turn Proxied off for the record (Change a web proxy's settings).

The service is suspended

A web proxy whose service or domain is suspended answers this page until you pay (Failed payments and suspended services).

The browser gives up because each answer is another redirect.

Your origin redirects plain HTTP to HTTPS

The edge connects to the origin over plain HTTP unless Connect to the origin over TLS is on. An origin that redirects plain HTTP to HTTPS then answers every request with another redirect. Set the origin to trust the X-Forwarded-Proto header, which the edge sets to https for visitors on HTTPS, or turn on TLS to the origin and use its HTTPS port (What your origin receives).

A redirect rule matches its own destination

The destination falls inside the rule's source path. Redirect requests with rules shows how to fix the rule.

With the Web application firewall on, a request that looks malicious gets a 403 page that reads The web application firewall blocked your request to protect this website from traffic that looks malicious. A request that looks suspicious gets a page titled Verify you are human (The web application firewall).

A browser gets the check again and again

A browser that passes is not asked again on that web proxy for 20 minutes, as long as its IP address stays the same. A visitor whose address changes, such as on a mobile network, can be asked again.

An API client or a script is blocked

Scripts cannot pass the check. You cannot change the rules or exempt a path, so turn the WAF off for the web proxy, or serve the API from a name of its own with the WAF off (Change a web proxy's settings).

The edge limits how fast one IP address can send requests. Over the limit, it answers 429 with {"error":"Too many requests"} and a Retry-After of 1 second. After 8 refused requests in a row, it refuses every request from that address for 5 minutes.

The limit applies to each address on every web proxy, and you cannot change it. Slow the client down, and wait at least 1 second after a 429 before it sends again. Visitors behind one address, such as an office network, share the limit.

A request body larger than the web proxy's limit gets 413 with {"error":"Request body too large"}. Raise Max request body (MB) on the Origin tab, up to 100 MB. A web proxy cannot pass a larger body.

The edge keeps copies of images, fonts, audio and video for up to an hour (Caching). An answer with X-Cache: HIT came from the cache. You cannot clear the cache yourself, so give a changed file a new URL, such as a new file name, or contact support to clear it.

The player's game says it cannot find or resolve the server.

The name has a typo

Players must type the join address exactly, such as survival-smp.coritan.gg. Copy it from the join address's page on Edge Proxy.

The join address is suspended

The name stops resolving while the server, or the external server's plan, is suspended. It comes back with the service (Failed payments and suspended services).

The server was deleted

Coritan deleted its join addresses with it, and the names became free for anyone to take. Create a join address for the server you use now (Create a join address).

The address needs a port

Bedrock players join on port 19132, the game's default. For a TCP service, players add the Edge port from the Overview tab after the name, such as survival-smp.coritan.gg:61234 (Editions and ports).

Players use your own domain

A linked domain works only once its badge shows Verified (A custom domain does not work).

A Java player gets the offline message when the edge cannot open a connection to your server within 5 seconds. The message is the While the server is offline text from the Server list tab, or Server is currently offline when that is empty (What players see).

The server is not running

Start it, and wait until its console prints the game's Done line (Players cannot connect). A free server that is asleep starts when a player joins (Sleeping and waking).

The game listens on another port

A join address to a server hosted here forwards to the server's primary port. Make the game's port primary (Make another port primary).

An external server does not answer

Check the address, the port, your router's port forward and your firewall, then select Test connection on the Connection tab (Connect a server you host elsewhere).

Your server takes the connection from the edge, then turns the player away.

PROXY protocol is on, and the server does not expect the header

The edge starts each connection with a PROXY protocol version 2 header, which the server cannot read. For a server hosted here, set the server to accept the header, or create another join address without it: you cannot change PROXY protocol once a join address exists. For an external server, turn PROXY protocol off on the Connection tab, or set your server to accept the header.

prevent-proxy-connections is true in server.properties

The server compares the address each player connects from with the one they signed in to Minecraft from, and sees the edge's address instead. Set it to false, or use a join address with PROXY protocol on and set the server to accept the header.

To make a server accept the header:

• Paper: set proxies.proxy-protocol: true in config/paper-global.yml.
• Velocity: set haproxy-protocol = true in velocity.toml.
• Waterfall: set proxy_protocol: true on the listener in config.yml.

A server that expects the header refuses players who join at its own address instead of the join address, because their connections carry no header.

The edge answers some joins itself, before they reach your server (What players see).

There is no proxy associated with this domain.

The name reaches the edge, but no join address or linked domain has it. Check the name, or link the domain on the join address's Custom domain tab (Use your own domain for a join address).

This proxy route is currently suspended.

The join address is suspended, or players reach it through a linked domain that Coritan has not verified or has marked CNAME lost.

Please rejoin to verify your connection.

The edge is under a flood, or the player's address has too many connections open. Join again, and the second attempt goes through.

Your IP is temporarily blocked for suspicious activity.

The player's address opened too many connections in a short time. Wait, then join again. Players who share one address, such as on a school network, share its limit.

This proxy is at capacity. Please try again shortly.

The edge carries all the players it can take. Join again shortly.

PROXY protocol is on. The edge sends the header when a player joins, but not when it asks your server for its server list entry, so a server that requires the header does not answer that request. Joins keep working (Customise the server list entry).

Each player's connection reaches your server from the edge's address, so logs and IP bans see that address. To pass on each player's own address, use a Java or TCP service join address with PROXY protocol on, or keep it off on a Java join address and install a plugin that reads the player's address from the handshake (What your server receives). A Bedrock join address passes on neither.

The player's game is older than version 26.50

Join addresses carry Bedrock players over NetherNet, which the game uses from version 26.50. The player must update the game.

The server speaks only RakNet

A Bedrock server must accept NetherNet connections. Update the server to a version that does. The check on an external server can still show Online for such a server (How Coritan checks your server).

The server is a Java server with Bedrock crossplay

For a server hosted here, create a Minecraft Java join address, and Bedrock players join at the same name on port 19132 (Let Bedrock players join a Java server). The edge does not carry Bedrock players to an external server through Geyser.

The badge on the join address's Custom domain tab says what Coritan found. Use your own domain for a join address lists every message.

The badge stays Pending

Coritan cannot see a CNAME from the name to the join address. Check the record at your DNS provider, then select Check now. If the provider can send traffic through its own network, turn that off for the record.

The badge shows CNAME lost

6 checks in a row did not find the record, and players can no longer join at the domain. Publish the record again, then select Check now.

Java players reach a different server

An SRV record for the name, such as _minecraft._tcp.play.example.com, still points somewhere else. Java looks it up before the CNAME, so delete it.

The badge shows the result of Coritan's last check of your server (How Coritan checks your server). Select Test connection on the Connection tab to check again at once.

Nothing answers

The check reads No Minecraft Java server answered on that address and port, or the Bedrock one. Check that the server is running, the Port, your router's port forward, and that your firewall allows the Edge addresses (Set up your server).

Something else answers

The server answered, but not with a valid status: or Something answered, but it is not a Bedrock server means the port or the Edition is wrong. Check both on the Connection tab.

PROXY protocol is on

The check sends no PROXY protocol header, so a server that requires one does not answer it. Players can still join.

Coritan forwards only to a public address that is yours (Addresses Coritan cannot forward to). It refuses a private or reserved address, a hostname that does not resolve, an address of one of Coritan's own edges, and another customer's server. The address you enter is the one your server listens on, never your join address or the address it resolves to. Connect a server you host elsewhere lists each message with its fix.

Coritan could not set up the external server after you paid. The Activity table on its Billing tab lists Provisioning failed with the reason. Contact support with the service number.