>_ NetDevKit
5xx Cloudflare & Edge Error

HTTP 523 Origin Is Unreachable — Reverse Proxy & Gateway Troubleshooting

Error 523 Origin Is Unreachable occurs when an intermediate router returns ICMP Destination Unreachable (Host or Network Unreachable), or when BGP route announcements for the origin subnet withdraw.

Status Code523 Origin Is Unreachable
Specification / OriginCloudflare Edge Code 523
Failure LayerBGP Routing / Anycast / Cloud Tunnel
Retry SafetySafe for idempotent GET/HEAD with exponential backoff + jitter

Interactive HTTP 523 Live Probe & Log Command Builder

Enter your target endpoint below to generate copy-ready curl latency breakdown probes and origin bypass tests:


  

    Related diagnostics:
    Nginx & Caddy Proxy Generator → ·
    X.509 SSL Certificate Decoder → ·
    Offline JWT Expiry Inspector →
  






  
Production Root Causes & Remediation Guide

  
Commonly happens after changing cloud Elastic IPs without updating DNS, null-routed origin IPs during DDoS mitigation at upstream ISPs, or stopped cloudflared tunnel daemons when using Cloudflare Tunnel.

  
Step-by-Step Engineering Fix

  
Confirm public route reachability (mtr -rwzbc 20 <origin-ip>), verify your hosting provider has not null-routed the IP, or check systemctl status cloudflared for tunnel deployments.

  
Recommended Nginx / Reverse-Proxy Configuration Snippet

  
# Verify end-to-end Layer-3 routing and ICMP reachability
ping -c 4 203.0.113.10
systemctl status cloudflared







  
Frequently Asked Questions (HTTP 523)

  
  

    Why does Error 523 appear immediately instead of waiting 15 seconds like 522?
    
523 triggers immediately when an upstream router actively replies with ICMP Destination Unreachable (no route to host) rather than silently dropping packets.

  

  
  

    Which infrastructure layer generates HTTP 523 Origin Is Unreachable?
    
HTTP 523 (Cloudflare Edge Code 523) typically originates at the BGP Routing / Anycast / Cloud Tunnel layer. Error 523 Origin Is Unreachable occurs when an intermediate router returns ICMP Destination Unreachable (Host or Network Unreachable), or when BGP route announcements for the origin subnet withdraw.

  

  
  

    Should API clients automatically retry HTTP 523 responses?
    
HTTP 523 is safe to retry ONLY for idempotent methods (such as GET or HEAD) using exponential backoff with random jitter.

  

  






  
Browse All 25 Gateway, Proxy & Cloud HTTP Error Guides

  

    
      HTTP 400 (Bad Request)
    
      HTTP 401 (Unauthorized)
    
      HTTP 403 (Forbidden)
    
      HTTP 404 (Not Found)
    
      HTTP 405 (Method Not Allowed)
    
      HTTP 408 (Request Timeout)
    
      HTTP 413 (Content Too Large)
    
      HTTP 422 (Unprocessable Content)
    
      HTTP 429 (Too Many Requests)
    
      HTTP 431 (Request Header Fields Too Large)
    
      HTTP 499 (Client Closed Request)
    
      HTTP 500 (Internal Server Error)
    
      HTTP 501 (Not Implemented)
    
      HTTP 502 (Bad Gateway)
    
      HTTP 503 (Service Unavailable)
    
      HTTP 504 (Gateway Timeout)
    
      HTTP 507 (Insufficient Storage)
    
      HTTP 511 (Network Authentication Required)
    
      HTTP 520 (Web Server Returned an Unknown Error)
    
      HTTP 521 (Web Server Is Down)
    
      HTTP 522 (Connection Timed Out)
    
      HTTP 523 (Origin Is Unreachable)
    
      HTTP 524 (A Timeout Occurred)
    
      HTTP 525 (SSL Handshake Failed)
    
      HTTP 526 (Invalid SSL Certificate)
    
  






  


  
Copied to clipboard