🐛 Connectivity pre-checks report region2 failures with automatic IP selection; forcing IPv4 resolves them #1758

Describe the bug

Cloudflared connectivity pre-checks consistently report a transport failure for region2.v2.argotunnel.com when using the default IP version selection.

The actual Cloudflare Tunnel connections work successfully, including QUIC connections to region2. However, the connectivity pre-checks report a degraded environment and suggest opening outbound port 7844.

The issue was reproduced on two different systems on the same LAN:

• Windows 11, cloudflared 2026.10.0: TCP/HTTP2 connectivity to region2 fails in the pre-check.
• Home Assistant OS 18.3, cloudflared 2026.9.3: UDP/QUIC connectivity to region2 fails in the pre-check.

In both environments, adding --edge-ip-version=4 makes all connectivity pre-checks pass, without changing any firewall or router settings.

This suggests a possible issue involving automatic IPv4/IPv6 selection during connectivity pre-checks. However, the exact root cause has not been established.

To Reproduce

Environment A: Windows 11

1. Install cloudflared 2026.10.0 on Windows 11 (amd64).

2. Run:

   cloudflared tunnel --hello-world --loglevel info

3. Observe the following connectivity pre-check results:

   DNS Resolution    region1.v2.argotunnel.com  PASS
   DNS Resolution    region2.v2.argotunnel.com  PASS
   UDP Connectivity  region1.v2.argotunnel.com  PASS
   UDP Connectivity  region2.v2.argotunnel.com  PASS
   TCP Connectivity  region1.v2.argotunnel.com  PASS
   TCP Connectivity  region2.v2.argotunnel.com  FAIL
   Cloudflare API    api.cloudflare.com:443     PASS
   
   WARNING: Allow outbound TCP on port 7844.
   SUMMARY: Environment ready with degraded transport.
   

4. Stop cloudflared and run:

   cloudflared tunnel --edge-ip-version 4 --hello-world --loglevel info

5. Observe that all checks now pass:

   DNS Resolution    region1.v2.argotunnel.com  PASS
   DNS Resolution    region2.v2.argotunnel.com  PASS
   UDP Connectivity  region1.v2.argotunnel.com  PASS
   UDP Connectivity  region2.v2.argotunnel.com  PASS
   TCP Connectivity  region1.v2.argotunnel.com  PASS
   TCP Connectivity  region2.v2.argotunnel.com  PASS
   Cloudflare API    api.cloudflare.com:443     PASS
   
   SUMMARY: Environment is healthy.
   

6. Repeat both commands. The same difference was reproduced across consecutive runs.

Environment B: Home Assistant OS

1. Run Home Assistant OS 18.3 in a virtual machine on a QNAP NAS, using bridged networking.

2. Install the Home Assistant Cloudflared add-on version 7.0.17, running cloudflared 2026.9.3.

3. Configure a remotely managed Cloudflare Tunnel using a tunnel token.

4. Start the add-on without additional run parameters.

5. Observe:

   DNS Resolution    region1.v2.argotunnel.com  PASS
   DNS Resolution    region2.v2.argotunnel.com  PASS
   UDP Connectivity  region1.v2.argotunnel.com  PASS
   UDP Connectivity  region2.v2.argotunnel.com  FAIL
   TCP Connectivity  region1.v2.argotunnel.com  PASS
   TCP Connectivity  region2.v2.argotunnel.com  PASS
   Cloudflare API    api.cloudflare.com:443     PASS
   
   WARNING: Allow outbound QUIC traffic on port 7844
   SUMMARY: Environment ready with degraded transport.
   

6. Add the following run parameter to the add-on configuration:

   --edge-ip-version=4
   

7. Restart the add-on.

8. Observe that all connectivity pre-checks now pass:

   DNS Resolution    region1.v2.argotunnel.com  PASS
   DNS Resolution    region2.v2.argotunnel.com  PASS
   UDP Connectivity  region1.v2.argotunnel.com  PASS
   UDP Connectivity  region2.v2.argotunnel.com  PASS
   TCP Connectivity  region1.v2.argotunnel.com  PASS
   TCP Connectivity  region2.v2.argotunnel.com  PASS
   Cloudflare API    api.cloudflare.com:443     PASS
   
   SUMMARY: Environment is healthy.
   cloudflared will use 'quic' as primary protocol.
   

Tunnel ID: Not included for privacy. The Windows reproduction uses a temporary Quick Tunnel and does not require a named tunnel.

cloudflared config:

Windows:

No configuration file.
Quick Tunnel (--hello-world).
Default IP selection versus --edge-ip-version 4.

Home Assistant:

Remotely managed tunnel using a token.
Additional run parameter:
--edge-ip-version=4

Expected behavior

Connectivity pre-checks should accurately report whether the required transport is reachable.

When IPv6 is unavailable but IPv4 connectivity works, automatic IP selection should ideally fall back to a working IPv4 address rather than reporting a misleading transport failure.

At minimum, diagnostic output should distinguish an IPv6 routing or address-selection failure from an actual outbound TCP/UDP port 7844 block.

Environment and versions

Environment A

• OS: Windows 11
• Architecture: amd64
• cloudflared version: 2026.10.0
• Network: Wi-Fi, IPv4 LAN
• IPv6: No usable IPv6 Internet route observed

Environment B

• OS: Home Assistant OS 18.3
• Virtualization: QNAP Virtualization Station, bridged networking
• Architecture: amd64
• cloudflared version: 2026.9.3
• Home Assistant Cloudflared add-on: 7.0.17
• IPv6: Local ULA (fd...) and link-local (fe80...) addresses visible; no global IPv6 address or IPv6 default gateway shown in the Home Assistant network UI

Network

• Router: AVM FRITZ!Box 7590
• IPv4 LAN
• No firewall or router changes were needed to make all pre-checks pass.

Logs and errors

Windows — default IP selection

2026-10-08T11:05:28Z INF |  UDP Connectivity  region1.v2.argotunnel.com  PASS    QUIC connection successful                   |
2026-10-08T11:05:28Z INF |  UDP Connectivity  region2.v2.argotunnel.com  PASS    QUIC connection successful                   |
2026-10-08T11:05:28Z INF |  TCP Connectivity  region1.v2.argotunnel.com  PASS    HTTP/2 connection successful                 |
2026-10-08T11:05:28Z INF |  TCP Connectivity  region2.v2.argotunnel.com  FAIL    HTTP/2 connection is blocked or unreachable  |
2026-10-08T11:05:28Z INF |  WARNING: Allow outbound TCP on port 7844.                                                         |
2026-10-08T11:05:28Z INF |  SUMMARY: Environment ready with degraded transport. cloudflared will proceed using 'quic'.        |

Windows — forced IPv4

2026-10-08T11:05:41Z INF |  UDP Connectivity  region1.v2.argotunnel.com  PASS    QUIC connection successful    |
2026-10-08T11:05:41Z INF |  UDP Connectivity  region2.v2.argotunnel.com  PASS    QUIC connection successful    |
2026-10-08T11:05:41Z INF |  TCP Connectivity  region1.v2.argotunnel.com  PASS    HTTP/2 connection successful  |
2026-10-08T11:05:41Z INF |  TCP Connectivity  region2.v2.argotunnel.com  PASS    HTTP/2 connection successful  |
2026-10-08T11:05:41Z INF |  SUMMARY: Environment is healthy. cloudflared will use 'quic' as primary protocol.  |

Home Assistant OS — forced IPv4

2026-10-08T11:13:34Z INF |  UDP Connectivity  region1.v2.argotunnel.com  PASS    QUIC connection successful    |
2026-10-08T11:13:34Z INF |  UDP Connectivity  region2.v2.argotunnel.com  PASS    QUIC connection successful    |
2026-10-08T11:13:34Z INF |  TCP Connectivity  region1.v2.argotunnel.com  PASS    HTTP/2 connection successful  |
2026-10-08T11:13:34Z INF |  TCP Connectivity  region2.v2.argotunnel.com  PASS    HTTP/2 connection successful  |
2026-10-08T11:13:34Z INF |  SUMMARY: Environment is healthy. cloudflared will use 'quic' as primary protocol.  |

Additional context

• On Windows, all 10 IPv4 addresses returned for region2.v2.argotunnel.com were individually tested with Test-NetConnection -Port 7844. All returned TcpTestSucceeded: True.
• TCP reachability alone does not prove successful TLS/HTTP2 negotiation.
• IPv6 connectivity tests to one address in each region failed on Windows. The tests showed Loopback Pseudo-Interface 1 and SourceAddress ::1, indicating no usable IPv6 route for those destinations.
• The Windows Quick Tunnel successfully registered an actual QUIC connection even when the HTTP/2 region2 pre-check failed.
• The Home Assistant named tunnel also registered QUIC connections to both Cloudflare regions even when the UDP region2 pre-check failed.
• Using --loglevel debug on Windows did not reveal which specific destination IP caused the pre-check failure.
• The fact that forcing IPv4 resolves the warnings on both systems strongly suggests an IP-family selection or fallback issue, but does not conclusively establish the root cause.
• Windows and Home Assistant exhibit different failing transport checks, so they may represent related but distinct problems.

Related report:

• QUIC connection failed homeassistant-apps/app-cloudflared#1030

Workaround: Add --edge-ip-version=4 to cloudflared's run parameters.

It would be useful to know whether the pre-check implementation is expected to retry IPv4 after an unsuccessful IPv6 attempt, and whether its diagnostics could identify the selected address family and destination IP.