Cloudflare Tunnel Not Working? Fix Error 1033 in Minutes

Cloudflare Tunnel Error 1033 usually appears when Cloudflare cannot find a healthy cloudflared connector for your tunnel. In simple words, Cloudflare knows your domain should send traffic through a tunnel, but the computer, VPS, Docker container, Raspberry Pi, or server running the tunnel is no longer connected properly.

This can be frustrating because your website, local app, dashboard, Home Assistant instance, development project, or self-hosted service may suddenly stop loading even though the server itself is still online. The good news is that Error 1033 is usually fixable without changing your website files or rebuilding your server.

In most cases, the issue comes down to one of these problems: the cloudflared service stopped, the server restarted, the tunnel token is invalid, the connector cannot reach Cloudflare, Docker is down, or the tunnel is connected to the wrong configuration.

What Is Cloudflare Tunnel Error 1033?

Cloudflare Error 1033 means Cloudflare cannot locate a healthy cloudflared connector for the requested tunnel. Your domain may still point correctly to Cloudflare, but Cloudflare has no active tunnel connection available to forward the visitor request to your local or origin service.

A Cloudflare Tunnel works by creating an outbound connection from your server to Cloudflare. Instead of opening inbound ports such as port 80 or port 443 on your router or firewall, your server runs the cloudflared connector and connects outward to Cloudflare.

When someone visits your domain, Cloudflare sends the request through that active connector. If the connector stops running or loses its connection, Cloudflare cannot reach your service and displays Error 1033.

Cloudflare distinguishes this error from a normal origin server issue. Error 1033 means the tunnel itself is unavailable. A Cloudflare Tunnel 502 error usually means the tunnel is online, but cloudflared cannot reach the local application configured in your ingress rule.

Common Reasons Why Cloudflare Tunnel Error 1033 Happens

Before applying fixes, it helps to understand why the error appears. This avoids changing DNS records, reinstalling Cloudflare, or modifying firewall settings unnecessarily.

• The cloudflared process has stopped running.
• The server, PC, Raspberry Pi, or VPS was restarted.
• The cloudflared system service failed after boot.
• Your Docker container stopped or crashed.
• The tunnel token was replaced, deleted, or copied incorrectly.
• Your server lost internet access or has outbound firewall restrictions.
• The tunnel is configured on one server but cloudflared is running on another.
• The cloudflared installation is outdated or damaged.
• Your tunnel is inactive in the Cloudflare dashboard.
• The service is running, but with the wrong tunnel name, UUID, token, or configuration file.

How to Check Whether Your Cloudflare Tunnel Is Active

The fastest way to confirm the problem is to check the tunnel status inside Cloudflare. Sign in to your Cloudflare dashboard, open your account, and go to Networking > Tunnels.

Find the tunnel connected to your domain or application. Cloudflare may show one of several statuses.

• Healthy: The tunnel is connected and working normally.
• Inactive: The tunnel exists, but no cloudflared connector is currently connected.
• Down: The tunnel was previously connected but is no longer available.
• Degraded: The tunnel has partial connectivity and may have lost some connections.

If the tunnel is inactive or down, the problem is almost certainly on the machine running cloudflared. Start by checking whether the cloudflared process or service is active.

You can also check your tunnel from the command line. Run the following command on the server where cloudflared is installed:

cloudflared tunnel list

This command lists the tunnels available to your Cloudflare account and can help confirm whether you are using the correct tunnel name or tunnel UUID.

Fix 1: Restart the cloudflared Service

The most common solution for Cloudflare Tunnel Error 1033 is restarting the cloudflared service. This is especially useful after a server reboot, unexpected shutdown, software update, network interruption, or cloudflared crash.

Restart cloudflared on Ubuntu, Debian, or Linux VPS

Run this command:

sudo systemctl restart cloudflared

Then verify that the service started successfully:

sudo systemctl status cloudflared

Look for a status such as active (running). If cloudflared restarts correctly, refresh your domain after one or two minutes. Cloudflare may need a short moment to recognize the connector as healthy again.

If the status shows failed, exited, or inactive, continue to the next troubleshooting steps because the service is not starting correctly.

Restart cloudflared on CentOS, AlmaLinux, Rocky Linux, or Fedora

The commands are generally the same on most modern Linux distributions:

sudo systemctl restart cloudflared

Then check the service:

sudo systemctl status cloudflared

If your server uses an older service manager, you may need to use:

sudo service cloudflared restart

Restart cloudflared on Windows

If you installed cloudflared as a Windows service, open Command Prompt or PowerShell as Administrator and run:

sc stop cloudflared

Then run:

sc start cloudflared

You can also restart it from the Windows Services panel. Press the Windows key, search for Services, find the cloudflared service, right-click it, and choose Restart.

If cloudflared was started manually from Command Prompt, reopen the terminal and run the original tunnel command again. For example:

cloudflared tunnel run your-tunnel-name

Restart cloudflared on macOS

If cloudflared is running through Homebrew services, use:

brew services restart cloudflared

If you run it manually, stop the existing process and start the tunnel again:

cloudflared tunnel run your-tunnel-name

Fix 2: Check Whether cloudflared Is Actually Running

Sometimes the cloudflared service appears installed, but the process is not active. This can happen after a server reboot, system update, Docker restart, memory issue, or accidental terminal closure.

On Linux, run:

ps aux | grep cloudflared

If cloudflared is running, you should see a process with a command similar to cloudflared tunnel run or cloudflared tunnel –no-autoupdate run.

If you only see the grep command and no active cloudflared process, the tunnel is not running. Restart the service or launch the tunnel manually.

On Windows, open Task Manager and search for cloudflared.exe. If it is missing, the tunnel connector is not running.

On macOS, open Activity Monitor and search for cloudflared. You can also use Terminal:

ps aux | grep cloudflared

Fix 3: Enable cloudflared to Start Automatically After a Reboot

A very common reason for Error 1033 is that the server rebooted overnight, after a VPS maintenance event, after a power outage, or after a system update. The website then stays offline because cloudflared was not configured to start automatically.

On Linux systems using systemd, enable cloudflared at startup:

sudo systemctl enable cloudflared

Then start it immediately:

sudo systemctl start cloudflared

To confirm that automatic startup is enabled, run:

sudo systemctl is-enabled cloudflared

The result should say enabled.

This matters because Cloudflare Tunnel depends on the cloudflared connector being active. Your web server, Node.js app, WordPress site, or local dashboard can be fully operational, but Cloudflare will still show Error 1033 if cloudflared does not start after reboot.

Fix 4: Check Your cloudflared Logs for the Real Error

If restarting cloudflared does not work, logs are the fastest way to identify the actual cause. The error may be related to authentication, an invalid token, DNS resolution, permissions, network restrictions, or a broken configuration file.

Check cloudflared Logs on Linux

Run this command:

sudo journalctl -u cloudflared -n 100 –no-pager

This shows the latest 100 log lines from the cloudflared service. Look for messages containing words such as error, failed, authentication, token, connection, permission denied, or unable to connect.

For live logs, use:

sudo journalctl -u cloudflared -f

Keep that command running while restarting cloudflared in another terminal. This lets you see the exact error as the service attempts to connect.

Common cloudflared Log Messages and What They Mean

• Authentication failed: Your tunnel token, credentials file, or certificate may be invalid.
• Failed to connect to edge: The server may have an internet, DNS, firewall, proxy, or outbound network issue.
• No such file or directory: Your configuration file or credentials JSON file path may be incorrect.
• Permission denied: The cloudflared service user cannot access the configuration or credentials file.
• Unable to start tunnel: The tunnel ID, token, tunnel name, or configuration may not match.
• Connection terminated: The server may have unstable internet access, network filtering, or an interrupted outbound connection.

Fix 5: Verify Your Tunnel Token and Configuration

Cloudflare Tunnel Error 1033 can also happen when cloudflared starts with the wrong token or an outdated configuration. This is common when you create a new tunnel, delete an old tunnel, migrate to another server, copy commands from old notes, or run multiple tunnels on the same VPS.

Open Cloudflare Zero Trust or your Cloudflare dashboard, go to Networking > Tunnels, select your tunnel, and use the setup or replica connector section to get the latest installation command.

For token-based tunnels, Cloudflare may provide a command similar to this:

cloudflared service install YOUR_TUNNEL_TOKEN

Do not copy a token from an old server unless you are certain it belongs to the same active tunnel. If you accidentally install cloudflared using a token for another tunnel, your domain can continue showing Error 1033.

After reinstalling the service with the correct token, restart cloudflared and check the tunnel status in the dashboard.

Check a Named Tunnel Configuration File

If you use a named tunnel instead of a token-based installation, your configuration may be stored in a file such as:

/etc/cloudflared/config.yml

A typical configuration includes a tunnel name or UUID, a credentials JSON file, and ingress rules. Confirm that the tunnel ID matches the correct tunnel listed in your Cloudflare dashboard.

Also check that the credentials file path is valid. If the credentials JSON file was moved, deleted, renamed, or given incorrect permissions, cloudflared may fail to connect.

A typical issue looks like this: cloudflared is installed correctly, but the service tries to use an old credential file from a deleted tunnel. The service may keep restarting, while Cloudflare reports Error 1033 to visitors.

Fix 6: Reinstall the cloudflared Service

If cloudflared refuses to start or the service configuration is corrupted, reinstalling the service can be faster than manually repairing every setting. This is especially useful when the tunnel worked before but stopped after moving servers or changing your tunnel configuration.

First, stop the existing service:

sudo systemctl stop cloudflared

Then uninstall the old service if needed:

sudo cloudflared service uninstall

Next, get the latest connector command from the Cloudflare dashboard for your specific tunnel. Install the service again using the fresh tunnel token provided there.

After installation, enable and start the service:

sudo systemctl enable cloudflared

sudo systemctl start cloudflared

Finally, verify it:

sudo systemctl status cloudflared

Refresh the Cloudflare dashboard and wait for the tunnel to show as healthy.

Fix 7: Update cloudflared to the Latest Version

An outdated cloudflared version may not always directly cause Error 1033, but older versions can have compatibility issues, bugs, connection problems, or missing improvements. Updating is a sensible step when your tunnel keeps disconnecting without a clear reason.

On Linux, check your installed version:

cloudflared –version

Then update cloudflared using the installation method appropriate for your operating system. If you installed it through a package manager, use your normal update process. If you installed it manually from a package file, download and install the latest stable version from Cloudflare’s official cloudflared installation instructions.

After updating, restart the service:

sudo systemctl restart cloudflared

Updating is particularly important for long-running VPS setups where cloudflared was installed months or years earlier and has not been maintained.

Fix 8: Check Internet, DNS, Firewall, and Outbound Network Access

Cloudflare Tunnel does not need inbound ports to be open, which is one of its biggest advantages. However, cloudflared still requires outbound internet access to connect with Cloudflare.

If your server cannot reach Cloudflare due to firewall rules, VPN routing, company network restrictions, DNS issues, proxy restrictions, or a failed internet connection, the tunnel will become inactive and visitors may see Error 1033.

Check Basic Internet Connectivity

On Linux, try:

ping -c 4 1.1.1.1

If this fails, your server may not have working internet access.

Then test DNS resolution:

ping -c 4 cloudflare.com

If the IP ping works but the domain ping fails, your server may have a DNS problem. Check your resolver configuration, hosting provider DNS settings, or local network setup.

Check Firewall Rules

Cloudflared usually needs to make outbound connections to Cloudflare. A strict firewall, proxy, corporate network, or hosting provider security policy can block those connections.

Check whether your server has outbound traffic restrictions. On Ubuntu, you can review UFW status:

sudo ufw status verbose

If you use a cloud provider firewall, such as AWS Security Groups, Google Cloud firewall rules, DigitalOcean Cloud Firewalls, Hetzner Firewall, Vultr Firewall, or Oracle Cloud security rules, make sure outbound HTTPS and required outbound connectivity are permitted.

Do not open random inbound ports just to fix Error 1033. Cloudflare Tunnel is designed to avoid exposing inbound ports. The issue is usually that cloudflared cannot create or maintain its outbound connection.

Fix 9: Check Docker If Your Tunnel Runs in a Container

Many users run Cloudflare Tunnel through Docker, especially for self-hosted apps, Home Assistant, Portainer, Nginx Proxy Manager, media servers, development tools, and personal dashboards.

If the Docker container stops, crashes, or loses its token, Cloudflare will show Error 1033.

Check all running containers:

docker ps

Look for a container named cloudflared or a similar custom name. If it is not listed, check stopped containers:

docker ps -a

Restart the container:

docker restart cloudflared

If your container uses another name, replace cloudflared with the correct container name.

Then inspect the logs:

docker logs cloudflared –tail 100

Look for token errors, authentication failures, connection errors, or repeated restart loops.

Make Sure Docker Restarts cloudflared Automatically

Your cloudflared container should have a restart policy. Without one, a server reboot or container crash can leave your tunnel offline.

For Docker Compose, use a restart policy such as:

restart: unless-stopped

This helps Docker bring the tunnel back after a reboot, as long as Docker itself starts correctly.

After editing your Docker Compose file, recreate the container:

docker compose up -d

Then confirm that the tunnel appears healthy in Cloudflare.

Fix 10: Make Sure You Are Running the Correct Tunnel

It is easy to create multiple tunnels while testing Cloudflare Tunnel. You may have one tunnel for a staging server, one for a production server, one for your laptop, and one older tunnel that is no longer used.

If your hostname is mapped to Tunnel A but cloudflared is running Tunnel B, Cloudflare cannot route traffic correctly. The result can be Error 1033 even though cloudflared appears to be running.

Check the hostname route inside Cloudflare and confirm which tunnel it points to. Then compare that tunnel with the tunnel name, tunnel UUID, or token used on your server.

For named tunnels, run:

cloudflared tunnel list

Then verify the tunnel ID against your config file.

For token-based tunnels, open the tunnel in the Cloudflare dashboard and get a new connector command. This is often the easiest way to eliminate uncertainty.

Fix 11: Check Whether Your Server Is Running Out of Memory or Disk Space

Cloudflared is lightweight, but it can still stop working if your server is severely overloaded, out of memory, out of disk space, or constantly killing processes.

On Linux, check memory usage:

free -h

Check disk usage:

df -h

Check whether the system killed cloudflared because of memory pressure:

dmesg | grep -i killed

If your VPS has very little RAM and runs a database, WordPress, Node.js, Docker, Redis, Nginx, and cloudflared together, memory pressure can cause background services to fail unexpectedly.

Free up disk space, restart unnecessary services, add swap if suitable for your server, or consider upgrading the VPS plan if resource exhaustion keeps returning.

Fix 12: Restart the Server as a Last Basic Check

If cloudflared, Docker, networking, and system services are behaving strangely, a server reboot can restore normal operation. This should not be your first fix, but it is reasonable after checking logs and service status.

On Linux, run:

sudo reboot

After the server returns online, confirm that cloudflared starts automatically:

sudo systemctl status cloudflared

If cloudflared is inactive after every reboot, enable the service using:

sudo systemctl enable cloudflared

Cloudflare Tunnel Error 1033 vs Error 502

Many users confuse Error 1033 and Error 502 because both can appear when a site behind Cloudflare Tunnel is unavailable. However, they point to different parts of the connection.

Error 1033: Cloudflare cannot find a healthy cloudflared connector. The tunnel is inactive, down, disconnected, or not properly registered.

Error 502: The tunnel is active, but cloudflared cannot reach your local website or service. For example, your ingress rule points to localhost:3000, but your Node.js app is not running on port 3000.

For Error 1033, focus on cloudflared service status, tunnel token, network connectivity, Docker status, and tunnel configuration.

For Error 502, focus on the local application, service port, web server, container network, localhost address, and ingress configuration.

How to Prevent Cloudflare Tunnel Error 1033 in the Future

Once your tunnel is working again, take a few preventive steps so your website does not go offline after the next reboot, network issue, or service crash.

• Enable cloudflared to start automatically after reboot.
• Use a Docker restart policy if cloudflared runs in Docker.
• Keep cloudflared updated.
• Monitor tunnel health in the Cloudflare dashboard.
• Keep a copy of your correct tunnel name, UUID, and setup method.
• Document where your config.yml and credentials JSON files are stored.
• Check server RAM, disk space, and CPU usage regularly.
• Use reliable outbound internet connectivity on the origin machine.
• Avoid deleting old tunnel credentials until you confirm the new tunnel is working.
• Create a backup connector or replica if your setup needs better availability.

For business websites, client portals, production dashboards, or important applications, it is smart to run more than one connector where possible. A second cloudflared connector on another reliable machine can help maintain availability if the primary server loses its connection.

Frequently Asked Questions

Why am I getting Cloudflare Error 1033?

You are getting Cloudflare Error 1033 because Cloudflare cannot find an active and healthy cloudflared connector for your tunnel. The cloudflared process may have stopped, the server may be offline, Docker may have crashed, or the tunnel token or configuration may be incorrect.

Does Error 1033 mean my website server is down?

Not always. Your web server or app may still be running normally, but Cloudflare cannot reach it because the tunnel connector is disconnected. Check cloudflared before assuming that Apache, Nginx, WordPress, Node.js, or your local application is down.

How long does Cloudflare Tunnel take to reconnect?

After cloudflared starts successfully, the tunnel often reconnects within seconds. However, allow one or two minutes for the Cloudflare dashboard and public hostname to fully reflect the healthy connection.

Do I need to open port 80 or 443 to fix Error 1033?

No. Cloudflare Tunnel is designed to work without opening inbound ports on your router or firewall. Error 1033 normally requires you to restore the outbound cloudflared connection, not expose your server to the internet.

Can restarting cloudflared fix Error 1033?

Yes. Restarting cloudflared is the most common fix, especially after server restarts, power outages, service crashes, or temporary network interruptions.

Why does Cloudflare Tunnel stop after restarting my VPS?

The cloudflared service may not be enabled at startup. Use the command sudo systemctl enable cloudflared so the service launches automatically whenever your server boots.

Can an invalid tunnel token cause Error 1033?

Yes. If cloudflared is using an incorrect, expired, deleted, or mismatched token, it may fail to connect to the intended tunnel. Get a fresh connector command from the correct tunnel in the Cloudflare dashboard.

Final Thoughts

Cloudflare Tunnel Error 1033 is usually not a DNS problem, website code problem, or WordPress problem. It means Cloudflare cannot find a working cloudflared connector for the tunnel handling your domain.

Start by checking whether the tunnel is active in the Cloudflare dashboard. Then restart cloudflared, check service logs, verify the tunnel token or config file, confirm your Docker container is running, and make sure cloudflared starts automatically after a reboot.

ALSO READ:

• Why Can’t I Download Snapchat? 10 Ways to Fix this Issue
• How to Connect Xbox One Controller to PC (USB, Bluetooth, Wireless)
• Grindr Google Authorization Failed? How to Fix the “Please Try Again Later” Error
• Teleport Failure “Response Code Is Not 200”: 10 Fixes That Work