Many HTTP requests to my server fail with
524 (Origin time-out). The resources that fail to be delivered are not always the same. Sometimes they work, and the next request they don't.
I whitelisted the Cloudflare IPs. Unfortunately this can't help much because the source IPs that actually hit my server are from a french Cloudflare server whose IPs (172.68.51.*) are not in the official Cloudflare IP list. So I temporarily added a firewall rule that allows everything (all IPs, all Ports, all protocols, etc.). Also I don't have any
Block rules (which might override the allow everything rule).
What is even stranger is that the Windows firewall doesn't log any blocked requests for the timed-out resources. Also IIS doesn't log any requests for those resources so the problem has to be some time before IIS is involved.
If I completely disable the Windows firewall everything works as expected (all resources succeed to be delivered / no time-outs). If I do the requests via another domain (one that isn't mapped to Cloudflare) again everything works.
What might be the cause of the problem?
For testing I used Cloudflare's development mode (no caching but still proxying) because obviously there are no problems with resources that are already cached by Cloudflare.
Update: Even with bypassing all rules (Changing "Inbound connections" from "Block (default)" to "Allow") it doesn't work so it can't be a rule problem. The problem has to lie somewhere between disabling the firewall (works) and enabling the firewall but allowing all inbound and outbound connections (doesn't work).
Wireshark shows TCP Retransmission errors when the firewall is on. When disabling the firewall they don't occur: