Hiddos

Protected IP Returns 502

Troubleshoot 502 Bad Gateway responses when accessing a service through a protected IP.

Problem

An HTTP or HTTPS request through the protected IP returns 502 Bad Gateway. This generally means the proxy did not receive a valid response from the origin, but you must confirm the cause using the origin rule and origin logs.

Common Causes

Origin Rule Mismatch

The protocol, proxy port, origin address, origin port, or domain does not match the application.

Origin Unavailable

The service is not listening, is overloaded, times out, or returns an invalid response.

Network Access Blocked

A firewall, security group, or route blocks forwarding traffic.

TLS Misconfiguration

The HTTPS certificate, domain, SNI, or certificate chain is incorrect.

Troubleshooting

1. Check the Origin Rule

Open Origin Configuration for the instance and verify:

  • Protocol and proxy port.
  • Origin server address and port.
  • Domain used by HTTP/HTTPS rules.
  • Scheduling policy and other protocol-specific options.

2. Test the Origin from a Trusted Network

Send a request using the real protocol and port. Virtual hosts and HTTPS services require the correct domain; testing the IP alone is insufficient.

curl -I --resolve example.com:443:192.0.2.10 https://example.com/
Replace the sample domain and IP. If the test fails, use the connection error, HTTP status, and origin logs to continue diagnosis.

3. Check the Origin

  • Confirm the service is listening on the target port.
  • Review application and reverse-proxy error logs.
  • Check CPU, memory, connection counts, and upstream dependencies.
  • Confirm firewall and security-group access for verified forwarding sources.

4. Check HTTPS

  • The certificate is valid.
  • The certificate matches the forwarding domain.
  • The certificate chain is complete.
  • The origin completes a TLS handshake using the correct SNI.

Apply and Verify a Fix

  1. Correct the origin protocol, port, domain, or server based on the diagnosis.
  2. Save the rule and wait for the page to confirm completion.
  3. Test again through the production domain associated with the protected IP.
  4. Review origin access logs to confirm that the request reached the intended service.
  5. If the issue remains, restore the previous configuration and collect evidence for further diagnosis.
Do not open the origin port to the entire internet just to diagnose a 502 response. Assess the risk before relaxing access and restore the restriction immediately after testing.

Support

If the issue remains unresolved, email hy.swzx@hiddos.cn with:

  • Instance ID, protected IP, and access domain.
  • Origin protocol, proxy port, and origin address.
  • Event time, frequency, and complete response.
  • Origin access logs, error logs, and relevant configuration screenshots.

Exposed Origin IP

Troubleshoot attacks that bypass the protected IP and reach the origin directly.

Privacy Policy

How Hiddos collects, uses, and protects your personal information