# Troubleshoot proxies and join addresses > Fixes for web proxies that show an error, players who cannot join, custom domains that fail and external servers that do not connect. Source: https://docs.coritan.com/proxies/troubleshooting/ This page covers what goes wrong once a web proxy, a join address, a custom domain or an external server is running. The messages that a form shows while you create or change one are in the troubleshooting section of that task's own page. ## A web proxy shows a 502 or 504 error page When the edge cannot get an answer from your origin, visitors get an error page: `502` when the connection fails, and `504` when the origin does not answer within the origin timeout. The page names the failure, such as `Connection refused`, and shows a ray ID to quote when you [contact support](/support/conversations/). The `Coritan-Error` response header carries the failure's code, such as `connect_refused`, and the `Coritan-Ray` header carries the ray ID. A client that asks for JSON, or requests a path that starts with `/api/`, gets the same facts as JSON instead of the page: ```json { "error": "Bad Gateway", "status": 502, "reason": "connect_refused", "reason_label": "Connection refused", "message": "The origin server actively refused the connection.", "domain": "www.example.com", "ray_id": "8f3a1c2b9d4e5f60" } ``` The answer also carries `hint`, `edge` and `timestamp`. To see each origin that the edge tried and how each attempt ended, turn on development mode ([Use development mode while you debug](/proxies/web-proxies/settings/#use-development-mode-while-you-debug)). The failures are: `No origin configured` (`no_backends_configured`) : The web proxy has no origin to forward to. Set the **Origin host** and **Port** on the **Origin** tab ([Change a web proxy's origin](/proxies/web-proxies/change-the-origin/)). `All origins marked down` (`all_origins_unhealthy`) : Every origin failed several times in a row, so the edge skips them for a short time and then tries them again. The failure named on the earlier error pages, or development mode's list of attempts, says which of the causes below applies. `Connection refused` (`connect_refused`) : Nothing listens on the origin's address and port, or a firewall refuses the connection. Check that the site's server is running, and that the **Port** on the **Origin** tab is the port it listens on. `Connect timed out` (`connect_timeout`) : The origin did not accept the connection in time. A host that is down, or a firewall that drops connections from the internet, looks like this. Check that the host is up, and that its firewall accepts connections to the port from the internet. `Origin unreachable` (`connect_unreachable`) : The edge has no network path to the origin's address. Check the address in **Origin host**. `Origin DNS failed` (`connect_dns`) : The **Origin host** is a hostname, and it did not resolve when the edge looked it up. Check the name's records at its DNS provider, or enter the origin's IP address. `Origin TLS failed` (`connect_tls`) : **Connect to the origin over TLS** is on, and the edge refused the origin's certificate or TLS version, or the port does not serve HTTPS. Give the origin a certificate for the origin host from a public certificate authority, or turn TLS off and use the origin's plain HTTP port ([Origins](/proxies/web-proxies/#origins)). `Connect failed` (`connect_failed`) : The edge could not open a connection for another reason. Check that the origin is online, and that its address and port are right. `Closed before replying` (`origin_closed_early`) : The origin accepted the connection, then closed it without an answer. Something on the port does not speak HTTP, or the site's application stopped in the middle of the request. Check the origin's own logs for the time on the error page. `Connection reset` (`origin_reset`) : The origin dropped the connection while the request was in progress. A restart, a process that ran out of memory, or another proxy in front of the application looks like this. Check the origin's logs. `Response timed out` (`read_timeout`) : The origin accepted the request, but did not finish its answer within the origin timeout, which is 60 seconds unless you changed it. This is the failure that answers `504`. Look for a slow page or a slow database query, or raise **Origin timeout (s)** on the **Origin** tab, up to 120 seconds. `WebSocket refused` (`ws_rejected`) : The origin answered a WebSocket request with something other than `101`. Check that the path accepts WebSocket connections. `Edge error` (`proxy_error`) : The request failed inside Coritan's edge, and nothing on your side causes it. [Contact support](/support/conversations/) with the ray ID. When every request fails just after you change the origin, check **PROXY protocol to origin** first. An origin that does not expect the header fails every request, so turn the switch off, or set the origin's web server to accept PROXY protocol version 2 ([Change a web proxy's origin](/proxies/web-proxies/change-the-origin/#troubleshooting)). ## Visitors see a certificate warning The edge serves the name's own certificate once it is `active`. Until then, the edge answers HTTPS with a certificate for another name, and browsers warn visitors. The **Certificate** card on the web proxy's **Overview** tab shows where the certificate stands. The card shows **Issuance in progress** : The certificate authority is still checking the name. Reload the page in a few minutes. The card shows **The last issuance failed** : The authority could not validate the name, and the card gives its reason. The name must resolve to the edge, or be in a DNS zone that Coritan hosts. Fix that, then select **Request certificate** ([Request or renew the certificate](/proxies/web-proxies/change-the-origin/#request-or-renew-the-certificate)). The web proxy has no certificate : **Request a certificate automatically** was off when you created it. Select **Request certificate** on the card. A certificate covers one name, so `example.com` and `www.example.com` each need their own ([Visitors see a certificate warning](/websites/troubleshooting/#visitors-see-a-certificate-warning)). ## Visitors see "This domain is not assigned to any active service on our network" The edge answers `404` with this page when the name reaches it but has no active web proxy. No web proxy has the exact name : `example.com` and `www.example.com` are separate names, and each needs its own web proxy. Create one for the name that visitors type ([Create a web proxy](/proxies/web-proxies/create-a-web-proxy/)). The web proxy is new : The edge can go on answering `404` for a few seconds after you create a web proxy. Reload the page. You deleted the web proxy : A proxied DNS record still sends visitors to the edge. Create a web proxy for the name, or turn **Proxied** off for the record ([Change a web proxy's settings](/proxies/web-proxies/settings/#troubleshooting)). The service is suspended : A web proxy whose service or domain is suspended answers this page until you pay ([Failed payments and suspended services](/billing/failed-payments/#a-service-is-suspended)). ## Visitors get too many redirects The browser gives up because each answer is another redirect. Your origin redirects plain HTTP to HTTPS : The edge connects to the origin over plain HTTP unless **Connect to the origin over TLS** is on. An origin that redirects plain HTTP to HTTPS then answers every request with another redirect. Set the origin to trust the `X-Forwarded-Proto` header, which the edge sets to `https` for visitors on HTTPS, or turn on TLS to the origin and use its HTTPS port ([What your origin receives](/proxies/web-proxies/#what-your-origin-receives)). A redirect rule matches its own destination : The destination falls inside the rule's source path. [Redirect requests with rules](/proxies/web-proxies/redirect-rules/#troubleshooting) shows how to fix the rule. ## The WAF blocks visitors or asks them to verify With the **Web application firewall** on, a request that looks malicious gets a `403` page that reads `The web application firewall blocked your request to protect this website from traffic that looks malicious.` A request that looks suspicious gets a page titled `Verify you are human` ([The web application firewall](/proxies/web-proxies/#the-web-application-firewall)). A browser gets the check again and again : A browser that passes is not asked again on that web proxy for 20 minutes, as long as its IP address stays the same. A visitor whose address changes, such as on a mobile network, can be asked again. An API client or a script is blocked : Scripts cannot pass the check. You cannot change the rules or exempt a path, so turn the WAF off for the web proxy, or serve the API from a name of its own with the WAF off ([Change a web proxy's settings](/proxies/web-proxies/settings/#troubleshooting)). ## Clients get 429 Too many requests The edge limits how fast one IP address can send requests. Over the limit, it answers `429` with `{"error":"Too many requests"}` and a `Retry-After` of 1 second. After 8 refused requests in a row, it refuses every request from that address for 5 minutes. The limit applies to each address on every web proxy, and you cannot change it. Slow the client down, and wait at least 1 second after a `429` before it sends again. Visitors behind one address, such as an office network, share the limit. ## Uploads fail with 413 A request body larger than the web proxy's limit gets `413` with `{"error":"Request body too large"}`. Raise **Max request body (MB)** on the **Origin** tab, up to 100 MB. A web proxy cannot pass a larger body. ## Visitors get an old copy of a file The edge keeps copies of images, fonts, audio and video for up to an hour ([Caching](/proxies/web-proxies/#caching)). An answer with `X-Cache: HIT` came from the cache. You cannot clear the cache yourself, so give a changed file a new URL, such as a new file name, or [contact support](/support/conversations/) to clear it. ## Players cannot find the server The player's game says it cannot find or resolve the server. The name has a typo : Players must type the join address exactly, such as `survival-smp.coritan.gg`. Copy it from the join address's page on [Edge Proxy](https://www.coritan.com/dashboard/proxies/game). The join address is suspended : The name stops resolving while the server, or the external server's plan, is suspended. It comes back with the service ([Failed payments and suspended services](/billing/failed-payments/#a-service-is-suspended)). The server was deleted : Coritan deleted its join addresses with it, and the names became free for anyone to take. Create a join address for the server you use now ([Create a join address](/proxies/join-addresses/create-a-join-address/)). The address needs a port : Bedrock players join on port `19132`, the game's default. For a **TCP service**, players add the **Edge port** from the **Overview** tab after the name, such as `survival-smp.coritan.gg:61234` ([Editions and ports](/proxies/join-addresses/#editions-and-ports)). Players use your own domain : A linked domain works only once its badge shows `Verified` ([A custom domain does not work](#a-custom-domain-does-not-work)). ## Players see the offline message when they join A Java player gets the offline message when the edge cannot open a connection to your server within 5 seconds. The message is the **While the server is offline** text from the **Server list** tab, or `Server is currently offline` when that is empty ([What players see](/proxies/join-addresses/#what-players-see)). The server is not running : Start it, and wait until its console prints the game's `Done` line ([Players cannot connect](/managed-containers/troubleshooting/#players-cannot-connect)). A free server that is asleep starts when a player joins ([Sleeping and waking](/managed-containers/free-servers/#sleeping-and-waking)). The game listens on another port : A join address to a server hosted here forwards to the server's primary port. Make the game's port primary ([Make another port primary](/managed-containers/ports/#make-another-port-primary)). An external server does not answer : Check the address, the port, your router's port forward and your firewall, then select **Test connection** on the **Connection** tab ([Connect a server you host elsewhere](/proxies/external-servers/connect-an-external-server/#troubleshooting)). ## Every player is refused through a join address Your server takes the connection from the edge, then turns the player away. **PROXY protocol** is on, and the server does not expect the header : The edge starts each connection with a PROXY protocol version 2 header, which the server cannot read. For a server hosted here, set the server to accept the header, or create another join address without it: you cannot change **PROXY protocol** once a join address exists. For an external server, turn **PROXY protocol** off on the **Connection** tab, or set your server to accept the header. `prevent-proxy-connections` is `true` in `server.properties` : The server compares the address each player connects from with the one they signed in to Minecraft from, and sees the edge's address instead. Set it to `false`, or use a join address with **PROXY protocol** on and set the server to accept the header. To make a server accept the header: - Paper: set `proxies.proxy-protocol: true` in `config/paper-global.yml`. - Velocity: set `haproxy-protocol = true` in `velocity.toml`. - Waterfall: set `proxy_protocol: true` on the listener in `config.yml`. A server that expects the header refuses players who join at its own address instead of the join address, because their connections carry no header. ## Players see a message from the edge The edge answers some joins itself, before they reach your server ([What players see](/proxies/join-addresses/#what-players-see)). `There is no proxy associated with this domain.` : The name reaches the edge, but no join address or linked domain has it. Check the name, or link the domain on the join address's **Custom domain** tab ([Use your own domain for a join address](/proxies/join-addresses/custom-domain/#troubleshooting)). `This proxy route is currently suspended.` : The join address is suspended, or players reach it through a linked domain that Coritan has not verified or has marked `CNAME lost`. `Please rejoin to verify your connection.` : The edge is under a flood, or the player's address has too many connections open. Join again, and the second attempt goes through. `Your IP is temporarily blocked for suspicious activity.` : The player's address opened too many connections in a short time. Wait, then join again. Players who share one address, such as on a school network, share its limit. `This proxy is at capacity. Please try again shortly.` : The edge carries all the players it can take. Join again shortly. ## The server list shows the offline message while players can join **PROXY protocol** is on. The edge sends the header when a player joins, but not when it asks your server for its server list entry, so a server that requires the header does not answer that request. Joins keep working ([Customise the server list entry](/proxies/join-addresses/server-list/#troubleshooting)). ## Your server logs the same address for every player Each player's connection reaches your server from the edge's address, so logs and IP bans see that address. To pass on each player's own address, use a Java or TCP service join address with **PROXY protocol** on, or keep it off on a Java join address and install a plugin that reads the player's address from the handshake ([What your server receives](/proxies/join-addresses/#what-your-server-receives)). A Bedrock join address passes on neither. ## Bedrock players cannot join The player's game is older than version 26.50 : Join addresses carry Bedrock players over NetherNet, which the game uses from version 26.50. The player must update the game. The server speaks only RakNet : A Bedrock server must accept NetherNet connections. Update the server to a version that does. The check on an external server can still show `Online` for such a server ([How Coritan checks your server](/proxies/external-servers/#how-coritan-checks-your-server)). The server is a Java server with Bedrock crossplay : For a server hosted here, create a **Minecraft Java** join address, and Bedrock players join at the same name on port `19132` ([Let Bedrock players join a Java server](/managed-containers/software/bedrock-crossplay/)). The edge does not carry Bedrock players to an external server through Geyser. ## A custom domain does not work The badge on the join address's **Custom domain** tab says what Coritan found. [Use your own domain for a join address](/proxies/join-addresses/custom-domain/#troubleshooting) lists every message. The badge stays `Pending` : Coritan cannot see a `CNAME` from the name to the join address. Check the record at your DNS provider, then select **Check now**. If the provider can send traffic through its own network, turn that off for the record. The badge shows `CNAME lost` : 6 checks in a row did not find the record, and players can no longer join at the domain. Publish the record again, then select **Check now**. Java players reach a different server : An `SRV` record for the name, such as `_minecraft._tcp.play.example.com`, still points somewhere else. Java looks it up before the `CNAME`, so delete it. ## An external server shows `Offline` The badge shows the result of Coritan's last check of your server ([How Coritan checks your server](/proxies/external-servers/#how-coritan-checks-your-server)). Select **Test connection** on the **Connection** tab to check again at once. Nothing answers : The check reads `No Minecraft Java server answered on that address and port`, or the Bedrock one. Check that the server is running, the **Port**, your router's port forward, and that your firewall allows the **Edge addresses** ([Set up your server](/proxies/external-servers/connect-an-external-server/#set-up-your-server)). Something else answers : `The server answered, but not with a valid status:` or `Something answered, but it is not a Bedrock server` means the port or the **Edition** is wrong. Check both on the **Connection** tab. **PROXY protocol** is on : The check sends no PROXY protocol header, so a server that requires one does not answer it. Players can still join. ## Coritan refuses an external server's address Coritan forwards only to a public address that is yours ([Addresses Coritan cannot forward to](/proxies/external-servers/#addresses-coritan-cannot-forward-to)). It refuses a private or reserved address, a hostname that does not resolve, an address of one of Coritan's own edges, and another customer's server. The address you enter is the one your server listens on, never your join address or the address it resolves to. [Connect a server you host elsewhere](/proxies/external-servers/connect-an-external-server/#troubleshooting) lists each message with its fix. ## An external server's status is `failed` Coritan could not set up the external server after you paid. The **Activity** table on its **Billing** tab lists `Provisioning failed` with the reason. [Contact support](/support/conversations/) with the service number.