Error 1033 indicates a problem with a Cloudflare Tunnel (previously called Argo Tunnel) connection. Cloudflare Tunnels let you connect your origin server to Cloudflare's network without opening public inbound ports — instead, the cloudflared daemon on your server creates an outbound-only encrypted tunnel. Error 1033 means the tunnel is either not running, has disconnected, or cannot route the request to the configured local service.
The cloudflared process on your origin server has stopped, crashed, or was never started. Without it, the tunnel does not exist.
The cloudflared daemon is running but has lost its connection to Cloudflare's network — possibly due to network issues, firewall changes, or resource exhaustion on the server.
The tunnel's ingress rules do not include a route for the hostname being requested, so cloudflared does not know where to forward the request.
SSH into your server and verify the cloudflared daemon is running.
systemctl status cloudflared
Go to Zero Trust > Networks > Tunnels in the Cloudflare dashboard. Verify your tunnel shows as Healthy/Active.
Check your cloudflared config.yml to ensure the hostname in question has a matching ingress rule that routes to the correct local service.
cat /etc/cloudflared/config.yml
If the daemon is running but the tunnel is unhealthy, restart it to re-establish the connection.
systemctl restart cloudflared
The origin web server refused or is not accepting connections from Cloudflare.
Cloudflare's TCP connection to the origin server timed out.
Cloudflare cannot reach the origin server because DNS resolution failed or the origin IP is unreachable.