Cloudflare Proxy and NAT VPS Ports: DNS Alone Is Not Enough

Cloudflare's standard HTTP proxy supports a defined set of ports; it does not automatically forward public HTTPS port 443 to any high origin port assigned to a NAT VPS. Verify the current feature and configuration you intend to use.

DNS-only vs proxied

In DNS-only mode, the browser connects directly to the resolved address and uses the URL's port. With proxied DNS, traffic goes through Cloudflare, so its supported protocols, ports, origin rules and product limits apply.

An A record contains only an address. Enabling the proxy does not itself specify a custom destination port. Likewise, placing a port number into the A record's address field is not valid configuration.

Evaluate your actual route

Check the NAT endpoint and whether a Cloudflare product can reach it in the way you need. Origin port overrides, tunnels and other products have distinct configuration and availability requirements. Do not assume a feature is included in every account or compatible with every protocol.

For non-HTTP TCP or UDP traffic, the standard website proxy is not a generic port-forwarding service. DNS-only may be appropriate for clients that support your assigned public port, but that leaves traffic connecting directly to the shared public address.

Keep TLS correct

Use an origin configuration that validates certificates appropriately. Avoid relying on an insecure encryption mode to hide an origin-routing problem. Test redirects, WebSockets and upload behavior after the network path works.

See DNS and port numbers, public ingress design and website troubleshooting.

Reference: Cloudflare supported network ports. Consult current documentation before choosing a configuration.