~30% of TCP connects to app "fareeqy" time out from Egypt via cdg edge (since 2026-10-17)

Questions / Help
1

Hi! Since around the platform-wide host reboots, a large share of new TCP connections to our app never complete the handshake when coming from our office network in Egypt.

Setup

  • App: fareeqy (primary region fra)
  • Hostnames: app.fareeqy.com (CNAME → fareeqy.fly.dev) and fareeqy.fly.dev, both affected
  • Addresses: shared IPv4 66.241.124.88, IPv6 2a09:8280:1::8a:63c9:0, both affected
  • Client: 41.39.53.x (Egypt). debug.fly.dev reports Fly-Region: cdg, edge 37.16.21.10

Symptom

  • curl fails with exit=28: Failed to connect to app.fareeqy.com port 443 after 10006 ms: Timeout was reached
  • DNS resolves in ~5ms, then time_connect=0: the SYN gets no SYN-ACK.
  • Worse when several connections open at once (MCP and browser clients do this).

Measurements (16 parallel requests per round, 3 rounds):

for i in $(seq 1 16); do curl -s -o /dev/null --connect-timeout 10 -w "%{http_code}\n" https://app.fareeqy.com/up & done; wait
  • 2026-10-17 04:27 UTC: 15/48 failed
  • 2026-10-17 04:38 UTC, after restarting both app machines: 13/48 failed
  • Same bursts from the same network to fly.io (37.16.18.81) and community.fly.io: 0 failures
  • check-host.net TCP connect from 25 nodes worldwide, 3 rounds: 74/75 connected

What we ruled out

  • The machines: connected requests are served in ~10ms, both app machines (185135db7e0028, d8d3296b721208) pass health checks, and restarting them changed nothing.
  • DNS: resolves instantly and consistently to the addresses above.

Traceroutes from the client (both go through Cogent to 79.127.195.x, then go dark):

to 66.241.124.88: ... 154.54.36.109 -> 79.127.195.36 -> * * *
to 37.16.18.81:   ... 154.54.72.109 -> 154.54.61.185 -> 79.127.195.35 -> * * *