Troubleshooting

Common issues and what they mean. One Access surfaces the extension's most recent per-flow error on the connection card, and maps Cloudflare's edge status codes to friendly messages.

"Your Access session expired — sign in again"

Your application token is no longer valid (a 302 to the Access login worker). Tap Sign In Again to re-authenticate. To stretch how long a session lasts, see Sessions.

"Access denied for this host"

You authenticated, but the Access policy doesn't allow your identity (HTTP 403). Check that your email/identity is in an Include rule on the host's Access application.

"This host's origin is unreachable"

The Cloudflare Tunnel behind the hostname is down or can't reach the origin (HTTP 521 / 523 / 530). Verify cloudflared (or your connector) is running on the origin side and the service is up.

"Couldn't resolve this host"

The Hostname you entered doesn't resolve. Double-check it's the exact Access-fronted hostname (e.g. ssh.example.com), not the .internal name.

The tunnel is up but SSH won't connect

• Make sure you're connecting to the DNS name you configured (e.g. myhost.internal) or the virtual IP displayed on that host's card, and to the port you set.
• Confirm the origin service actually listens on that port.

Nothing happens when I toggle on

• The first time, iOS asks permission to add a VPN configuration — approve it.
• On the Simulator there's no Network Extension, so the app runs a mock flow for UI testing; real tunneling only works on a device.

Reporting a bug

Email [email protected] with the host's edge status (from the connection card) and what you expected to happen.