Cloudflare tunnel

cloudflared on TrueNAS (192.168.2.203) connects homelab apps to the internet without port forwarding — required because of CGNAT. Use this when sites work on the LAN but public *.saxobroko.com URLs fail.

Tunnel architecture

flowchart LR
  USER[Browser / app] --> CF[Cloudflare edge DNS SSL WAF]
  CF --> TUN[cloudflared on TrueNAS]
  TUN --> NPM[Nginx Proxy Manager optional]
  TUN --> APP[Jellyfin Authentik Vault etc.]

Symptom pattern	Layer	FAQ cluster
All homelab URLs down at once	cloudflared stopped or NAS reboot	TUN-001, TUN-003
One URL down	That app or NPM route	Service matrix, DKR-*
LAN IP works, public fails	Tunnel or DNS	Outage runbook — step 2
403 from overseas	WAF geo block (expected)	CFL-* — not a tunnel bug

Integrated runbooks: Outage runbook · cloudflared · Restart cloudflared

42 entries — IDs TUN-001 through TUN-042.

TUN-001: All tunnel sites down at once (stream, dash, vault, dsm, sonarr…)

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: cloudflared container stopped on TrueNAS, or TrueNAS rebooted and app did not start. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Every homelab subdomain fails publicly around the same time; LAN IP 192.168.2.203 may still work. Likely cause: cloudflared container stopped on TrueNAS, or TrueNAS rebooted and app did not start. Fix: 1. Open https://192.168.2.203 on home Wi‑Fi — confirm TrueNAS is up. 2. TrueNAS → Apps → find cloudflared → confirm Running. 3. If stopped, Start; if running, Stop wait 5 sec, Start — Restart cloudflared. 4. Wait two minutes; test https://dsm.saxobroko.com.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See cloudflared or Common Issues. Deep dive: Restart cloudflared

TUN-002: cloudflared app missing from TrueNAS Apps list

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: App uninstalled, renamed, or hidden after TrueNAS update — may run as custom Docker app. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Cannot find cloudflared to restart; tunnel dead. Likely cause: App uninstalled, renamed, or hidden after TrueNAS update — may run as custom Docker app. Fix: 1. TrueNAS → Apps → Installed Applications — search "cloudflare". 2. Check Discover or Custom App if not under official charts. 3. Do not reinstall from scratch without Saxon — needs tunnel token from Vaultwarden/Zero Trust. 4. Note exact app name for future FAQs.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TrueNAS basics. Deep dive: Restart cloudflared

TUN-003: cloudflared crashes immediately after start

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Invalid or expired tunnel credentials, bad config mount, or Docker network glitch after update. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: App shows Running briefly then Error/Stopped; logs mention token or config error. Likely cause: Invalid or expired tunnel credentials, bad config mount, or Docker network glitch after update. Fix: 1. Open app Logs in TrueNAS — screenshot error (do not paste token publicly). 2. Single restart after TrueNAS fully booted (wait 5 min post-reboot). 3. If "invalid tunnel secret" — needs Saxon to refresh token in Zero Trust — do not guess. 4. After TrueNAS OS update, restart NAS once before cloudflared.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Common Issues. Deep dive: Restart cloudflared

TUN-004: Works on LAN (192.168.2.203) but not via public URL

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Classic tunnel failure — LAN bypasses cloudflared; public path broken. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Jellyfin or TrueNAS UI loads locally; stream.saxobroko.com or dsm.saxobroko.com fails from same house on mobile data test. Likely cause: Classic tunnel failure — LAN bypasses cloudflared; public path broken. Fix: 1. Restart cloudflared (TUN-001). 2. Zero Trust → Tunnels → connector shows Healthy green. 3. If unhealthy, check TrueNAS internet outbound (google.com on LAN). 4. Verify DNS CNAME to tunnel — DNS (DNS-005).

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See cloudflared troubleshooting. Deep dive: Restart cloudflared

TUN-005: Tunnel connector shows Inactive or Disconnected in Zero Trust

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: cloudflared not running, NAS offline, or house internet WAN down blocking outbound tunnel. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Cloudflare Zero Trust dashboard lists tunnel connector red/down. Likely cause: cloudflared not running, NAS offline, or house internet WAN down blocking outbound tunnel. Fix: 1. Confirm home internet works (NET-001). 2. Confirm TrueNAS online at .203. 3. Start cloudflared app; wait 60 seconds. 4. Refresh Zero Trust tunnel page — should show Connected with recent heartbeat.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-003. Deep dive: Restart cloudflared

TUN-006: After TrueNAS reboot tunnel does not come back automatically

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: App set not to auto-start, or start order — cloudflared launched before network ready. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: NAS restart; all public URLs dead until someone manually starts cloudflared. Likely cause: App set not to auto-start, or start order — cloudflared launched before network ready. Fix: 1. TrueNAS app settings → enable Start on boot / autostart if available. 2. Follow Power outage recovery boot order: router → NAS → wait → verify cloudflared. 3. Manually start cloudflared after each NAS reboot until autostart fixed. 4. Ask Saxon to fix chart settings permanently.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Turn everything on. Deep dive: Restart cloudflared

TUN-007: Multiple cloudflared connectors — which is production?

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Old test connector left registered — only TrueNAS @ 192.168.2.203 should be active homelab connector. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Zero Trust shows more than one connector; afraid to delete wrong one. Likely cause: Old test connector left registered — only TrueNAS @ 192.168.2.203 should be active homelab connector. Fix: 1. Match connector last seen timestamp with TrueNAS restarts. 2. Do not delete connectors without Saxon — may kill production tunnel. 3. Note connector ID tied to running app logs on NAS. 4. Clean up stale connectors only when Saxon confirms.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See cloudflared. Deep dive: Restart cloudflared

TUN-008: Changed tunnel config in dashboard — no effect

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: cloudflared picks up config from Cloudflare within minutes — sometimes needs restart; or edited wrong tunnel. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Edited public hostname in Zero Trust; behaviour unchanged after save. Likely cause: cloudflared picks up config from Cloudflare within minutes — sometimes needs restart; or edited wrong tunnel. Fix: 1. Confirm editing the homelab tunnel (not a test tunnel). 2. Wait two minutes. 3. Restart cloudflared on TrueNAS. 4. Hard refresh browser incognito.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-012. Deep dive: Restart cloudflared

TUN-009: House internet slow — are tunnels broken?

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Tunnel adds small overhead but does not usually kill LAN speed — separate from Wi‑Fi/NBN issues. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Slow NBN; wonder if cloudflared makes everything slower. Likely cause: Tunnel adds small overhead but does not usually kill LAN speed — separate from Wi‑Fi/NBN issues. Fix: 1. Test LAN copy to NAS — if slow, see NET-011 not tunnel. 2. Tunnel keepalives use minimal bandwidth. 3. Fix WAN slowness with ISP/UniFi first. 4. Public streaming slowness may be upload speed + transcode — Media won't play.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Network general. Deep dive: Restart cloudflared

TUN-010: Only one subdomain fails — others fine

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Wrong public hostname → internal URL mapping for that one app — tunnel partially configured. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: e.g. radarr.saxobroko.com down; sonarr.saxobroko.com works. Likely cause: Wrong public hostname → internal URL mapping for that one app — tunnel partially configured. Fix: 1. Zero Trust → tunnel → Public Hostnames → find failing host. 2. Compare internal URL/port to working sibling app on TrueNAS. 3. Fix URL (e.g. http://192.168.2.203:7878) and save. 4. Restart cloudflared if needed (TUN-008).

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Restart Docker app. Deep dive: Restart cloudflared

TUN-011: dsm.saxobroko.com tunnel works but TrueNAS UI login fails

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Tunnel reaches NAS but TrueNAS admin auth or HTTPS setting issue — not tunnel down. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Cloudflare page loads; TrueNAS login or cert error after. Likely cause: Tunnel reaches NAS but TrueNAS admin auth or HTTPS setting issue — not tunnel down. Fix: 1. Try LAN https://192.168.2.203 with same credentials from Vaultwarden. 2. If LAN login fails, reset password procedure via Saxon — not tunnel fix. 3. Confirm tunnel points to correct TrueNAS HTTPS port. 4. See TrueNAS basics.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See DSM. Deep dive: Restart cloudflared

TUN-012: Public hostname points to wrong internal port

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Copy-paste error when adding tunnel route — common on arr stack with similar ports. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both* — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Cloudflare 502 or wrong app loads (Sonarr UI on Radarr URL). Likely cause: Copy-paste error when adding tunnel route — common on arr stack with similar ports. Fix: 1. On LAN, identify each app's port from TrueNAS Apps or Services. 2. Zero Trust → edit public hostname Service* URL to match. 3. Save and restart cloudflared. 4. Test one URL at a time in incognito.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See arr stack. Deep dive: Restart cloudflared

TUN-013: Should tunnel point to NPM instead of direct app port?

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Some hostnames route to NPM on LAN which forwards to apps — tunnel may target NPM IP:port not final app. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Saxon uses Nginx Proxy Manager for some paths; unsure tunnel target. Likely cause: Some hostnames route to NPM on LAN which forwards to apps — tunnel may target NPM IP:port not final app. Fix: 1. Check NPM for documented entry point. 2. Zero Trust hostname should match whatever Saxon configured — NPM or direct Docker port. 3. Do not change NPM and tunnel independently without both updates. 4. When in doubt, ask Saxon before repointing.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See NPM proxy FAQ when available. Deep dive: Restart cloudflared

TUN-014: stream.saxobroko.com (Jellyfin) tunnel issues

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Jellyfin container stopped, wrong tunnel port, or WAF 403 abroad — distinguish timeout vs 403. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Jellyfin public URL fails; LAN direct may work on 192.168.2.203:8096 or documented port. Likely cause: Jellyfin container stopped, wrong tunnel port, or WAF 403 abroad — distinguish timeout vs 403. Fix: 1. Confirm Jellyfin app Running on TrueNAS. 2. Verify tunnel hostname → Jellyfin HTTP port. 3. Test from AU — 403 abroad is WAF not tunnel (CFL-003). 4. Restart Jellyfin then cloudflared if 502.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Jellyfin for beginners. Deep dive: Restart cloudflared

TUN-015: Adding a new public hostname to the tunnel

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Requires Zero Trust tunnel entry + DNS + WAF — multi-step per Saxon's checklist. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: New Docker app needs newapp.saxobroko.com reachable from outside. Likely cause: Requires Zero Trust tunnel entry + DNS + WAF — multi-step per Saxon's checklist. Fix: 1. Confirm app works on LAN IP:port first. 2. Zero Trust → Tunnels → Public Hostname → add name and internal URL. 3. Verify DNS CNAME auto-created — DNS-031. 4. Add to block no aus and localnet full strict ssl — WAF.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See cloudflared adding hostname. Deep dive: Restart cloudflared

TUN-016: dash.saxobroko.com (Homepage) tunnel + Authentik

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Tunnel down or Access/Authentik layer failure — test tunnel first with dsm/stream. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Homepage dashboard unreachable publicly; Authentik login never reached. Likely cause: Tunnel down or Access/Authentik layer failure — test tunnel first with dsm/stream. Fix: 1. If all tunnel sites down → TUN-001. 2. If only dash fails, check tunnel maps to Homepage port and Homepage container running. 3. If tunnel OK but login loop → Cloudflare edge (CFL-008). 4. See Homepage.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Homepage for beginners. Deep dive: Restart cloudflared

TUN-017: vault.saxobroko.com (Vaultwarden) tunnel down

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: cloudflared or Vaultwarden container stopped — critical for credentials access abroad (if geo allowed). Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Password sync fails off-LAN; browser timeout to vault URL. Likely cause: cloudflared or Vaultwarden container stopped — critical for credentials access abroad (if geo allowed). Fix: 1. Remember vault is AU-only via WAF — test from Australia first. 2. Restart Vaultwarden app on TrueNAS, then cloudflared. 3. Bitwarden mobile may work offline with cached vault if already unlocked. 4. LAN fallback not available away from home.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Open Vaultwarden. Deep dive: Restart cloudflared

TUN-018: auth.saxobroko.com tunnel must stay up for SSO

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: auth tunnel down breaks SSO chain even if other apps partially work. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: dash/docs login fails; Authentik unreachable. Likely cause: auth tunnel down breaks SSO chain even if other apps partially work. Fix: 1. Priority restart: TrueNAS → cloudflared → Authentik app. 2. Test https://auth.saxobroko.com from AU incognito. 3. auth excluded from harsh geo block but still needs working tunnel from Cloudflare to NAS. 4. See Authentik.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See CFL-017. Deep dive: Restart cloudflared

TUN-019: request.saxobroko.com (Overseerr) not loading

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Overseerr container down or tunnel port wrong after reinstall. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Movie request site timeout or 502; LAN may work on internal port. Likely cause: Overseerr container down or tunnel port wrong after reinstall. Fix: 1. TrueNAS → restart Overseerr Docker app. 2. Verify tunnel internal URL matches new port if changed. 3. Restart cloudflared after tunnel edit. 4. See Overseerr guide.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See DNS-034. Deep dive: Restart cloudflared

TUN-020: music.saxobroko.com and photos.saxobroko.com failures

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Per-app tunnel hostname or container issue — not global tunnel unless both fail with all others. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Navidrome or Photos public URLs fail; other media apps OK. Likely cause: Per-app tunnel hostname or container issue — not global tunnel unless both fail with all others. Fix: 1. Restart specific app (Navidrome / Photos) in TrueNAS Apps. 2. Check each public hostname mapping in Zero Trust. 3. Test LAN ports documented in Services. 4. Global outage → TUN-001 instead.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Navidrome or Photos basics. Deep dive: Restart cloudflared

TUN-021: sonarr / radarr / prowlarr / lidarr tunnel issues

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Each has separate tunnel hostname and port — automation stack partially down common after updates. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: One or more arr admin UIs unreachable publicly. Likely cause: Each has separate tunnel hostname and port — automation stack partially down common after updates. Fix: 1. Identify which arr fails; restart that container. 2. Verify tunnel port matches app settings — arr stack. 3. Prefer LAN admin at home for heavy config changes. 4. Restart cloudflared once after batch tunnel edits.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See arr FAQ when available. Deep dive: Restart cloudflared

TUN-022: Tunnel logs show connection refused to 192.168.2.203:PORT

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Target app not listening on that port — container stopped or wrong port in tunnel config. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: cloudflared log repeats "connection refused" or "dial tcp" errors. Likely cause: Target app not listening on that port — container stopped or wrong port in tunnel config. Fix: 1. On LAN browser, try http://192.168.2.203:PORT directly. 2. Start/fix Docker app until LAN works. 3. Update tunnel public hostname port to match. 4. Restart cloudflared.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-012. Deep dive: Restart cloudflared

TUN-023: Tunnel logs show 502 or bad gateway from origin

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: App crash, reverse proxy misconfig, or HTTPS/http scheme mismatch on internal URL. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: cloudflared connects but app returns error upstream. Likely cause: App crash, reverse proxy misconfig, or HTTPS/http scheme mismatch on internal URL. Fix: 1. Toggle internal URL between http:// and https:// only if Saxon documented app requires TLS locally. 2. Default homelab Docker apps usually HTTP internal. 3. Restart app container. 4. Check app-specific logs in TrueNAS.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Restart Docker app. Deep dive: Restart cloudflared

TUN-024: Old CNAME to local.saxobroko.com breaks tunnel site

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Subdomain not migrated from pre-CGNAT local.saxobroko.com A record pattern to tunnel CNAME. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: DNS resolves but connection times out; legacy DNS pattern still on one subdomain. Likely cause: Subdomain not migrated from pre-CGNAT local.saxobroko.com A record pattern to tunnel CNAME. Fix: 1. Cloudflare DNS → replace legacy target with CNAME to *.cfargotunnel.com. 2. Add matching public hostname in Zero Trust. 3. Remove pointing at obsolete public IP. 4. See DNS-006.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Network legacy DNS. Deep dive: Restart cloudflared

TUN-025: plex.saxobroko.com legacy tunnel

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Plex legacy — may still have tunnel entry but low priority maintenance. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Plex URL fails; Saxon moved primary streaming to Jellyfin. Likely cause: Plex legacy — may still have tunnel entry but low priority maintenance. Fix: 1. Prefer stream.saxobroko.com (Jellyfin) for household streaming. 2. If Plex needed, check Plex legacy for current status. 3. Fix tunnel/container only if still intentionally used. 4. Do not confuse Plex and Jellyfin tunnel ports.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Plex legacy FAQ when available. Deep dive: Restart cloudflared

TUN-026: TrueNAS OS update broke cloudflared networking

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Docker network bridge reset — cloudflared lost route to host or apps. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Tunnel died immediately after TrueNAS upgrade; apps run but public URLs 502. Likely cause: Docker network bridge reset — cloudflared lost route to host or apps. Fix: 1. Reboot TrueNAS once fully updated (wait for pools healthy). 2. Restart cloudflared then affected apps. 3. Verify LAN IP .203 unchanged in UniFi fixed IP (UNI-020). 4. Check cloudflared logs for Docker network errors.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TrueNAS. Deep dive: Restart cloudflared

TUN-027: Duplicate tunnel public hostname entries

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Two public hostname rows for same subdomain in Zero Trust — conflicting backends. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Unpredictable routing; one app intermittently wrong. Likely cause: Two public hostname rows for same subdomain in Zero Trust — conflicting backends. Fix: 1. Zero Trust → tunnel → Public Hostnames → search duplicate subdomain. 2. Delete the wrong/older entry keeping one correct mapping. 3. Restart cloudflared. 4. Document correct internal URL in SaxDocs when stable.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-012. Deep dive: Restart cloudflared

TUN-028: Tunnel works from phone on 4G but not on home Wi‑Fi

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Hairpin NAT / DNS rebinding or local DNS override — unusual on this setup; or browser cache/captive portal. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Public URL loads on mobile data; same URL fails on home Wi‑Fi (or opposite). Likely cause: Hairpin NAT / DNS rebinding or local DNS override — unusual on this setup; or browser cache/captive portal. Fix: 1. Try incognito on home Wi‑Fi. 2. Use LAN IP for local admin instead of public URL when home (192.168.2.203). 3. Confirm not blocking yourself via WAF from misdetected country (rare on AU NBN). 4. Compare exact error: timeout vs 403 vs cert.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See DNS-023. Deep dive: Restart cloudflared

TUN-029: cloudflared high CPU on TrueNAS

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Temporary reconnect storm after outage, or log level debug — usually settles. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: NAS fans loud; cloudflared using noticeable CPU in TrueNAS reporting. Likely cause: Temporary reconnect storm after outage, or log level debug — usually settles. Fix: 1. If after outage, wait ten minutes for stable connection. 2. Single restart cloudflared — not repeated loops. 3. If sustained high CPU days, capture logs for Saxon. 4. Do not disable tunnel to "fix" CPU — loses all public access.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TrueNAS basics. Deep dive: Restart cloudflared

TUN-030: WebSockets / Jellyfin live stream fails via tunnel only

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Upload bandwidth limit, transcoding load, or client issue — tunnel supports WebSockets by default. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Playback stutters or fails on stream.saxobroko.com; LAN playback fine. Likely cause: Upload bandwidth limit, transcoding load, or client issue — tunnel supports WebSockets by default. Fix: 1. Test lower quality stream setting in Jellyfin client. 2. Check NBN upload speed saturation (torrents on PC). 3. Restart Jellyfin and cloudflared once. 4. See Media won't play.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Cloudflare edge (CFL-025). Deep dive: Restart cloudflared

TUN-031: Need to rotate tunnel token after leak

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Security rotation — requires Zero Trust regenerate + update TrueNAS app secret. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Tunnel credential exposed; Saxon wants new token deployed. Likely cause: Security rotation — requires Zero Trust regenerate + update TrueNAS app secret. Fix: 1. Saxon or authorised admin: Zero Trust → tunnel → Configure → rotate token. 2. Update TrueNAS cloudflared app environment/secret with new token from secure channel — not SaxDocs. 3. Restart cloudflared. 4. Confirm connector Healthy.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See YubiKey and Vaultwarden for credential storage. Deep dive: Restart cloudflared

TUN-032: Two tunnels in account — edited the wrong one

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Zero Trust has test vs production tunnel — hostname added to inactive tunnel. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Config changes have no effect; hostnames still broken. Likely cause: Zero Trust has test vs production tunnel — hostname added to inactive tunnel. Fix: 1. Identify tunnel name Saxon uses for homelab (check TrueNAS app config label). 2. Move public hostnames to correct tunnel. 3. Delete duplicate hostname from wrong tunnel. 4. Restart cloudflared on TrueNAS production connector only.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-007. Deep dive: Restart cloudflared

TUN-033: cloudflared version outdated after TrueNAS update

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Chart ships older cloudflared — update app catalog when Saxon schedules maintenance. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Warning in logs about deprecated version; intermittent disconnects. Likely cause: Chart ships older cloudflared — update app catalog when Saxon schedules maintenance. Fix: 1. Do not panic-update during outage unless logs demand it. 2. TrueNAS Apps → cloudflared → Update when pool healthy and Saxon approves. 3. Restart app post-update. 4. Verify tunnel Healthy in Zero Trust.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TrueNAS apps. Deep dive: Restart cloudflared

TUN-034: Firewall on TrueNAS blocking cloudflared outbound

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Rare local TrueNAS firewall rule or DNS failure blocking *.cloudflare.com outbound. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: LAN apps work; cloudflared logs cannot reach Cloudflare edge; connector down. Likely cause: Rare local TrueNAS firewall rule or DNS failure blocking *.cloudflare.com outbound. Fix: 1. Confirm TrueNAS can ping/browse internet (google.com from NAS shell if comfortable — or trust PC test on same LAN). 2. Dream Machine should allow LAN → WAN outbound by default. 3. Do not add inbound WAN rules — irrelevant for tunnel. 4. Fix house internet first (NET-001).

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Network. Deep dive: Restart cloudflared

TUN-035: Scheduled maintenance — safe to restart cloudflared?

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Brief tunnel blip during restart is normal — stagger with household notice. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Planned TrueNAS reboot; want to minimise public downtime. Likely cause: Brief tunnel blip during restart is normal — stagger with household notice. Fix: 1. Notify household streaming may pause ~2 minutes. 2. Reboot TrueNAS → wait for pools/apps → confirm cloudflared autostart (TUN-006). 3. Verify dsm.saxobroko.com before announcing all clear. 4. Check status.saxobroko.com monitors green.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Pool scrub for maintenance timing. Deep dive: Restart cloudflared

TUN-036: ICMP / ping Cloudflare tunnel endpoints

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Tunnels are HTTPS outbound connections — ping is not a meaningful test for beginners. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Want to "ping tunnel" like a device — unsure how. Likely cause: Tunnels are HTTPS outbound connections — ping is not a meaningful test for beginners. Fix: 1. Use Zero Trust connector Healthy status instead. 2. Test public URL in browser from AU. 3. Test LAN origin IP:port. 4. See TUN-004 diagnostic order in cloudflared.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Network general (NET-020). Deep dive: Restart cloudflared

TUN-037: cloudflared and Docker host network mode

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: If app binds 127.0.0.1 only, cloudflared on bridge cannot reach it — must use LAN IP 192.168.2.203:port. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Advanced question whether app uses host or bridge network — tunnel cannot reach localhost service. Likely cause: If app binds 127.0.0.1 only, cloudflared on bridge cannot reach it — must use LAN IP 192.168.2.203:port. Fix: 1. Tunnel internal URL should use 192.168.2.203 not 127.0.0.1 unless Saxon documented host networking. 2. Fix tunnel mapping to NAS LAN IP and published port. 3. Restart app and cloudflared. 4. Escalate network mode changes to Saxon.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See TUN-022. Deep dive: Restart cloudflared

TUN-038: Quick diagnostic order (copy Saxon's checklist)

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Same as cloudflared quick diagnostic — follow in sequence. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Overwhelmed — need step order for "site unreachable." Likely cause: Same as cloudflared quick diagnostic — follow in sequence. Fix: 1. Reach app on LAN at 192.168.2.203:port? 2. cloudflared Running in TrueNAS Apps? 3. DNS CNAME to *.cfargotunnel.com for that host? 4. Hostname in block no aus + localnet full strict ssl (if homelab)? 5. Testing from Australia without bad VPN?

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Common Issues. Deep dive: Restart cloudflared

TUN-039: Tunnel up but Cloudflare 403 — not 502

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: WAF geo block or Access policy — tunnel is fine; edge blocking user. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Connector healthy; browser shows Cloudflare block not gateway error. Likely cause: WAF geo block or Access policy — tunnel is fine; edge blocking user. Fix: 1. Confirm testing from AU (CFL-003). 2. Check Security Events for block reason. 3. Do not restart cloudflared for pure 403 abroad — expected. 4. If 403 in AU, see CFL-015 not TUN-001.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See WAF rules. Deep dive: Restart cloudflared

TUN-040: Full tunnel checklist still failing

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Deep issue — app crash, pool degraded, or credential rotation needed. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Completed TUN-038 all steps; public URL still broken from AU. Likely cause: Deep issue — app crash, pool degraded, or credential rotation needed. Fix: 1. Check TrueNAS pool health — not degraded (Pool degraded). 2. Collect cloudflared log excerpt (no secrets) and exact URL/error. 3. Restart specific failing app container once. 4. Escalate to Saxon with LAN-works-Y/N and connector Healthy-Y/N.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Handover first 24 hours. Deep dive: Restart cloudflared

TUN-041: Storj and old inbound services — why tunnel replaced them

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: CGNAT ended inbound connectivity — Storj archived; tunnel is replacement pattern. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Old notes mention port forwards and Storj; confused why tunnel is mandatory now. Likely cause: CGNAT ended inbound connectivity — Storj archived; tunnel is replacement pattern. Fix: 1. Do not attempt port forwarding on Dream Machine for homelab — ineffective. 2. All new external access via cloudflared + Cloudflare. 3. Read Network CGNAT (NET-014). 4. Legacy Plex/port docs are historical only.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See Network. Deep dive: Restart cloudflared

TUN-042: When to call Saxon vs fix tunnel yourself

Stack context: cloudflared on TrueNAS · CGNAT bypass Integrated runbooks: Outage runbook · cloudflared

Why this happens: Safe: restart cloudflared/app, verify LAN works. Not safe: new tokens, delete tunnel, reinstall TrueNAS app without backup. Diagnose (2 min): 1. Confirm whether the problem is LAN-only, public URL, or both — see Outage runbook. 2. Check Service matrix for which app/host owns the broken URL. 3. If a single device only, retry from a second device on the same network.

Symptoms: Unsure safety boundary for family fixing cloudflared. Likely cause: Safe: restart cloudflared/app, verify LAN works. Not safe: new tokens, delete tunnel, reinstall TrueNAS app without backup. Fix: 1. Always try TUN-001 restart and Restart cloudflared guide first. 2. Stop if logs mention invalid token, pool degraded, or data loss risk. 3. Write down symptoms using NET-020 order before calling. 4. Credentials only from Vaultwarden + YubiKey — never guess.

Verify: Repeat the original symptom check — it should be gone or clearly improved.

Still broken? See FAQ overview and Common Issues. Deep dive: Restart cloudflared