Skip to content

Commit 518dac1

Browse files
ranbelranbel
committed
clarify port forwarding
1 parent 319d8d7 commit 518dac1

File tree

1 file changed

+73
-70
lines changed
  • src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels

1 file changed

+73
-70
lines changed

‎src/content/docs/cloudflare-one/connections/connect-networks/troubleshoot-tunnels/diag-logs.mdx‎

Lines changed: 73 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,14 @@ head:
88
content: Tunnel diagnostic logs
99
---
1010

11-
Cloudflare Tunnel generates a set of diagnostic logs that can be used to troubleshoot issues with `cloudflared`. A diagnostic report covers a single instance of `cloudflared`.
11+
import {Details} from "~/components";
12+
13+
Cloudflare Tunnel generates a set of diagnostic logs that can be used to troubleshoot issues with `cloudflared`. A diagnostic report collects data from a single instance of `cloudflared` running on the local machine.
1214

1315
## Get diagnostic logs
1416

1517
The steps for getting diagnostic logs depend on your `cloudflared` deployment environment.
18+
1619
### Prerequisites
1720

1821
- Access to the `cloudflared` host being diagnosed
@@ -24,115 +27,115 @@ These instructions apply to remotely-managed and locally-managed tunnels running
2427

2528
1. (Linux only) Allow the `cloudflared` user to create RAW and PACKET sockets without root permissions:
2629

27-
```sh
28-
sudo setcap cap_net_raw+ep /usr/bin/traceroute && sudo setcap cap_net_raw+ep /usr/bin/traceroute
29-
```
30+
```sh
31+
sudo setcap cap_net_raw+ep /usr/bin/traceroute && sudo setcap cap_net_raw+ep /usr/bin/traceroute
32+
```
3033

3134
2. Get diagnostic logs:
3235

33-
```sh
34-
cloudflared tunnel diag
35-
```
36+
```sh
37+
cloudflared tunnel diag
38+
```
3639

37-
If multiple instances of `cloudflared` are running on the same host, specify the [metrics server address](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address) for the instance you want to diagnose:
40+
If multiple instances of `cloudflared` are running on the same host, specify the [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address) for the instance you want to diagnose. For example:
3841

39-
```sh
40-
cloudflared tunnel diag --metrics 127.0.0.1:20241
41-
```
42+
```sh
43+
cloudflared tunnel diag --metrics 127.0.0.1:20241
44+
```
4245

4346
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
4447

4548
### Docker
4649

47-
`cloudflared` reads diagnostic data from the `cloudflared` [metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address). Therefore, the metrics server must be exposed from the Docker container and reachable from the host machine.
50+
`cloudflared` reads diagnostic data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/). Therefore, the metrics server must be exposed from the Docker container and reachable from the host machine.
4851

49-
Run the following commands on the `cloudflared` host:
52+
1. Determine the tunnel's [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address). In Docker environments, the default IP and port is `0.0.0.0:20241`.
5053

51-
1. Verify that you can reach the metrics server address. For example, if the metrics server is listening at `0.0.0.0:20241`, run the following command:
54+
2. On the host machine, verify that you can reach the metrics server address. For example, if the metrics server is listening at `0.0.0.0:20241`, run the following command:
5255

53-
```sh
54-
curl localhost:20241/diag/tunnel
55-
```
56+
```curl
57+
curl localhost:20241/diag/tunnel
58+
```
5659

57-
This command should return a JSON:
58-
```json
59-
{
60-
"tunnelID": "ef96b330-a7f5-4bce-a00e-827ce5be077f",
61-
"connectorID": "d236670a-9f74-422f-adf1-030f5c5f0523",
62-
"connections": [
63-
{ "isConnected": true, "protocol": 1, "edgeAddress": "198.41.192.167"},
64-
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.200.113", "index": 1},
65-
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.192.47", "index": 2},
66-
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.200.73", "index": 3}
67-
],
68-
"icmp_sources": ["192.168.1.243", "fe80::c59:bd4a:e815:ed6"]
69-
}
70-
```
60+
This command should return a JSON:
61+
```json
62+
{
63+
"tunnelID": "ef96b330-a7f5-4bce-a00e-827ce5be077f",
64+
"connectorID": "d236670a-9f74-422f-adf1-030f5c5f0523",
65+
"connections": [
66+
{ "isConnected": true, "protocol": 1, "edgeAddress": "198.41.192.167"},
67+
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.200.113", "index": 1},
68+
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.192.47", "index": 2},
69+
{"isConnected": true, "protocol": 1, "edgeAddress": "198.41.200.73", "index": 3}
70+
],
71+
"icmp_sources": ["192.168.1.243", "fe80::c59:bd4a:e815:ed6"]
72+
}
73+
```
7174

72-
2. If the metrics server is not reachable, deploy the container again and expose the port:
75+
3. If the metrics server is unreachable, deploy the container again with port forwarding enabled. The diagnostic feature will try to request information from the Docker instance using ports `20241` to `20245`. You will need to forward one of these diagnostic ports to the metrics port.
7376

74-
```sh
75-
docker run -d -p 20241:20241 docker.io/cloudflare/cloudflared tunnel ...
76-
```
77+
```sh
78+
docker run -d -p <diagnostic_port>:<metrics_port> docker.io/cloudflare/cloudflared tunnel ...
79+
```
7780

78-
3. Take note of the container ID and then run the diagnostic:
81+
- `<diagnostic_port>` is any port in the range `20241` to `20245`.
82+
- `<metrics_port>` is the metrics port for the `cloudflared` instance you want to diagnose (obtained in Step 1).
7983

80-
```sh
81-
cloudflared tunnel diag --diag-container-id=<containerID>
82-
```
84+
3. Take note of the Docker container ID and then run the diagnostic:
8385

84-
Alternatively, you can specify the container's name instead of its ID:
85-
```sh
86-
cloudflared tunnel diag --diag-container-id=<containerName>
87-
```
86+
```sh
87+
cloudflared tunnel diag --diag-container-id=<containerID>
88+
```
89+
90+
Alternatively, you can specify the container's name instead of its ID:
91+
```sh
92+
cloudflared tunnel diag --diag-container-id=<containerName>
93+
```
8894

8995
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
9096

9197
### Kubernetes
9298

93-
`cloudflared` reads diagnostic data from the `cloudflared` [metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address). You must use port forwarding to expose the metrics server running in a Kubernetes cluster.
99+
The diagnostic feature will request data from the [tunnel metrics server](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address) using ports `20241` to `20245`. You will need to use port forwarding to allow the local `cloudflared` instance to connect to the metrics server on one of these ports.
94100

95-
Run the following commands on the `cloudflared` host:
96101

97-
1. Forward a local port to the `cloudflared` metrics server port:
102+
1. Determine the tunnel's [metrics server IP and port](/cloudflare-one/connections/connect-networks/monitor-tunnels/metrics/#check-the-metrics-server-address). In Kubernetes deployments, the default IP and port is `0.0.0.0:20241`.
98103

99-
```sh
100-
kubectl port-forward <pod> <known_port>:<metrics_port>
101-
```
104+
2. Enable port forwarding:
102105

103-
Alternatively, you can let `kubectl` choose an available local port:
106+
```sh
107+
kubectl port-forward <pod> <diagnostic_port>:<metrics_port>
108+
```
104109

105-
```sh
106-
kubectl port-forward <pod> :<metrics_port>
107-
```
110+
- `<pod>`: Name of the pod where the tunnel is running
111+
- `<diagnostic_port>` is any port in the range `20241` to `20245`.
112+
- `<metrics_port>` is the metrics port for the `cloudflared` instance you want to diagnose (obtained in Step 1).
108113

109-
2. Run the diagnostic:
114+
For example, if you set the metrics server address to `0.0.0.0:12345`:
110115

111-
```sh
112-
cloudflared tunnel diag --diag-pod-id=<podID>
113-
```
116+
```sh
117+
kubectl port-forward http-echo-6d4897585b-r8kfz 20244:12345
118+
```
119+
Connections made to local port `20244` are forwarded to port `1234` of the pod that is running the tunnel.
114120

115-
If the pod has multiple applications/services running and `cloudflared` is not the first in the pod, you must specify either the container ID or name:
121+
3. Run the diagnostic:
116122

117-
```sh
118-
cloudflared tunnel diag --diag-pod-id=<podID> --diag-container-id=<containerName>
119-
```
123+
```sh
124+
cloudflared tunnel diag --diag-pod-id=<podID>
125+
```
120126

121-
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
127+
If the pod has multiple applications/services running and `cloudflared` is not the first in the pod, you must specify either the container ID or name:
122128

129+
```sh
130+
cloudflared tunnel diag --diag-pod-id=<podID> --diag-container-id=<containerName>
131+
```
123132

124-
-------
125-
If you are managing the tunnel directly on the host:
126-
127-
1. Enable debug logging when you start the tunnel:
128-
129-
```sh
130-
cloudflared tunnel --loglevel debug --logfile cloudflared.log run <UUID>
131-
```
133+
This command will output the status of each diagnostic task and place a `cloudflared-diag-YYYY-MM-DDThh-mm-ss.zip` file in your working directory.
132134

133135
## cloudflared-diag files
134136

135137
The `cloudflared-diag-YYYY-MM-DDTHH-MM-SS.zip` archive contains the files listed below. The data in a file either applies to the `cloudflared` instance being diagnosed (`diagnosee`) or the instance that triggered the diagnosis (`diagnoser`). For example, if your tunnel is running in a Docker container, the diagnosee is the Docker instance and the diagnoser is the host machine instance. The diagnosee and diagnoser could also be the same instance.
136138

137139
| File name | Description | Instance |
138140
| -| - | - |
141+
| | | |

0 commit comments

Comments
 (0)