Proxy Header Forwarding
4 incident problems about Proxy Header Forwarding. Start with the reviewed ones.
Read first
When DNS changed but some clients still hit the old backendAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the DNS record is updated but resolver cache, HTTP/2 keepalive, or client pools hold on to the old target.Network3 min readWhen firewalld looks open but connections keep getting blockedAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when a port rule appears to exist but the connection fails because of zone, runtime/permanent drift, source binding, or an upstream firewall.Network3 min readHow to separate timeout and connection refused by network pathAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when DNS, route, firewall, proxy, and listener states all look like the same connection failure.Network3 min read
Recommended problems
Reviewed problems first, then problems with detailed scenarios.
All problems (4)
NETWORK-1205Proxy health page is green but user traffic still failsA proxy health endpoint looks fine, but actual user traffic still fails because the TLS hostname path chooses a different upstream certificate or route than the simple health check.NetworkIntermediate19 minProNETWORK-1200Reverse proxy timeout tuning hides that one upstream path is serializing requests unexpectedlyRaising timeout values improves symptoms temporarily, but the real issue is that a supposedly parallel backend path became serialized and now stalls under modest load.NetworkAdvanced23 minProNETWORK-1190WebSocket path fails only through reverse proxyA network team validates normal HTTP traffic and DNS, yet upgraded sessions still fail because one proxy hop never forwards the needed semantics.NetworkIntermediate18 minProNETWORK-1195Reverse proxy returns 499 and upstream timeout togetherA team reads public NGINX troubleshooting threads and focuses on 499 status codes. The real problem is a backend path slow enough that clients disconnect first.NetworkIntermediate19 minPro