JA EN
shiichan

No more dig or netcat: Cloudflare Tunnel now self-checks connectivity at startup!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#infrastructure#devops

Yahoo, it's Shiichan! Today I want to share a small but genuinely handy update for everyone using Cloudflare Tunnel.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Over on Cloudflare's Changelog, they announced that cloudflared, the connector for Cloudflare Tunnel, now runs connectivity pre-checks automatically at startup. This lands in cloudflared version 2026.5.2 and later.

The story so far

Until now, when a tunnel would not connect, you had to install dig and netcat yourself and run those commands by hand to verify your environment. It was a bit of a chore, honestly.

What changes

From now on, cloudflared checks things natively at startup for you. And when something is blocked, it even surfaces a specific remediation hint. Because it runs every time, it also catches later problems, like an overnight firewall policy change.

Dive Deep

On every cloudflared tunnel run (and cloudflared tunnel diag), it checks three things:

  • DNS resolution: whether region1.v2.argotunnel.com and region2.v2.argotunnel.com resolve to valid Cloudflare IPs.
  • Transport connectivity: outbound UDP (QUIC) and TCP (HTTP/2) on port 7844.
  • Management API: outbound TCP/443 to api.cloudflare.com for software updates.

Results print in a CLI table with three states:

  • Pass: the check succeeded.
  • Warn: a non-blocking issue, for example the Management API is unreachable so automatic updates will not work, but the tunnel still comes up.
  • Fail: a blocking issue, with a fix hint like Allow outbound UDP on port 7844.

If DNS cannot resolve, or both UDP and TCP fail on port 7844, cloudflared exits early instead of looping on opaque failed to dial errors.

To get the new behavior, upgrade cloudflared to 2026.5.2 or later. For more details, see the Connectivity pre-checks documentation.

Wrap-up

  • Starting with cloudflared 2026.5.2, connectivity pre-checks run automatically at startup.
  • The checks cover DNS resolution, UDP/TCP on port 7844, and TCP/443 to api.cloudflare.com.
  • Results come as Pass / Warn / Fail, and Fail includes a remediation hint.
  • No more running dig or netcat by hand, so this is a nice win for anyone operating or troubleshooting Cloudflare Tunnel!

Related posts