Cloudflare Intermitten 521 Error in front of Digital Ocean and Wordpress Multisite

Question

I keep getting intermittent 521 error code in my website. Here is a bit explanation about the architecture. I have a wordpress multisite server to serve client sites. The webserver is NGINX with PHP-FPM. Every site has its own domain, so for every client site, I have one Cloudflare account that connects to the wordpress.

Somewhat I have been getting intermittent 521 errors in all the sites to the server after some change in configuration (which I kind of forgot which one).

Before the errors, basically the Cloudflare configuration has 1) A name from the site to the multisite IP address 2) flexible ssl enabled 3) https rewrite and https redirect enabled 4) 1 page rule to redirect .domain to www.domain. 5) 1 page rule to bypass cache to wp-admin 6) 1 page rule to cache all content under wp-content/

But then suddenly the 521 errors happening to all microsites. What I tried to fix are 1) install SSL in multisite, set the domain to CNAME, set the HTTPS to Full (from Flexibe). 2) test enabling the development mode

Somewhat the problem still persist, so I tried curl one of the site and see the log in the nginx.

Above is example of the log. On the first section, on the left, I tried to curl based on timestamp while the right is the nginx log. In the 155xxxxxxx033 I got 521 Origin Down but there is no entry in the right. Only the previous 155xxxxxxxx00994 and next 155xxxxxx8901 . Also for this one microsite, I remove all the Page Rules.

After that, I tried again with changing the HTTPS configuration from Flexible to Full. Still the same.

I am now stuck in where to investigate next and what configuration I am missing. Really appreciate help and ideas.

Answer 1

I had this problem, and I had to turn off my fail2ban IP address jails/intrusion detection. Or add the Cloudflare IP addresses to your whitelist:

https://www.cloudflare.com/ips/

Answer 2

It's likely fail2ban, banning Cloudflare IPs. Follow Cloudflare's official guide here to restore visitor's original IP address. I had the same issue and doing this solved for me.

In brief,

1. Install mod_remoteip .
2. Cloudflare sends the visitor IP in the header as CF-Connecting-IP . Get that logged instead of Cloudflare's IP.
3. And add Cloudflare's IP ranges as trusted proxies in remoteip.conf .