Fix: Cloudflare Tunnel 502 Bad Gateway (Open WebUI)

You have configured a Cloudflare Tunnel (cloudflared) to expose your AI stack, but navigating to the domain returns a 502 Bad Gateway error.

Quick Fix

Ensure the cloudflared container is on the same Docker network as open-webui and uses the correct internal port:

# Cloudflare Dashboard Public Hostname
Service: http://open-webui:8080

(Note: Use port 8080, which is the internal container port, not the host-mapped port 3000).

Symptoms

• Browser Error: A Cloudflare-branded error page showing “502 Bad Gateway.”
• Log Messages: cloudflared logs show dial tcp: lookup open-webui: no such host or connection refused.
• Intermittent Access: The UI works locally (via IP:3000) but fails via the domain.

Root Causes

1. Network Isolation: The cloudflared container cannot “see” the open-webui container because they are on different Docker networks.
2. Wrong Internal Port: You are pointing the tunnel to port 3000 (the host port), but containers talk to each other via internal ports (8080).
3. Missing No-TLS Flag: If you are using HTTPS between the tunnel and the container without a valid cert, Cloudflare will drop the connection.

Step-by-Step Fix

1. Unified Networking

In your docker-compose.yml, ensure the tunnel and the UI share a network:

services:
  open-webui:
    networks: [ai_access]
  tunnel:
    image: cloudflare/cloudflared
    networks: [ai_access]

2. Dashboard Service Configuration

In the Cloudflare One dashboard (Zero Trust), edit your Public Hostname:

• Type: HTTP
• URL: open-webui:8080

3. Origin Server Settings

If you are using HTTPS for the internal service, go to HTTP Settings in the tunnel config and enable No TLS Verify. However, for local Docker networks, sticking to plain HTTP (http://open-webui:8080) is safer and easier.

Verification

1. From the cloudflared container, test resolution: docker exec -it tunnel curl -I http://open-webui:8080
2. If the response is 200 OK, the tunnel will function correctly.

Prevention

• Avoid Host-Mode Networking: While host-mode allows localhost access, it breaks the security boundary of the Docker network. Use a bridge network instead.
• Dedicated Tunnel Container: Run the tunnel as a sidecar in the same Compose file as your AI stack.

Related Guides

• Blueprint: Private AI Stack Blueprint.
• Tutorial: Deploying Ollama with Docker Compose.

FAQ

Q: Do I need to open ports on my router? A: No. Cloudflare Tunnels create an outbound-only connection, so you do not need to open any ports (like 80 or 443) on your firewall.