Fix: Dangling Reverse Proxy Routes Causing 502 Errors
A dangling route is a reverse proxy config entry pointing to a backend that no longer exists. Nginx starts fine, logs no startup error, but returns 502 for every request to that route.
Finding Dangling Routes in Nginx
Every proxy_pass target in your Nginx config should correspond to a running service. Check them manually:
# List all proxy_pass targets in your config: grep -r "proxy_pass" /etc/nginx/sites-enabled/ # Then verify each upstream is reachable: curl -sI http://127.0.0.1:PORT/
The Fix — Nginx
Option 1: Remove the dangling server block
# Remove or comment out the entire server block
# that points to the dead upstream:
# server {
# server_name old-app.example.com;
# location / { proxy_pass http://127.0.0.1:8080; }
# }
Option 2: Return 410 Gone for retired services
server {
server_name old-app.example.com;
return 410; # Gone — better than 502
}
Finding Dangling Routes in Traefik
In Traefik with Docker labels, dangling routes appear when a container is removed but nothing else is pointing at the hostname. Check Traefik's dashboard at http://localhost:8080 — any router showing 0 healthy servers is dangling.
# Check Traefik API for routers with no healthy backends:
curl http://localhost:8080/api/http/routers | python3 -c "import json,sys; [print(r['name'], r.get('status','?')) for r in json.load(sys.stdin)]"
After fixing — validate and reload
nginx -t && systemctl reload nginx
Paste your nginx.conf or docker-compose labels to detect dangling routes automatically.
Open Reverse Proxy Mapper →Frequently Asked Questions
Why does Nginx start successfully with a dangling proxy_pass?
Nginx validates configuration syntax at startup with nginx -t, but does not verify that upstream servers are reachable. The 502 error only appears at runtime when a request is made to the dangling route.
How do I prevent dangling routes when removing services?
Before removing a service from docker-compose.yml, remove or update its Nginx server block or Traefik labels first. After removing the service, run nginx -t && systemctl reload nginx to confirm the config is clean.
What is the difference between a 502 and a 504 from a reverse proxy?
502 Bad Gateway means the reverse proxy got an invalid response from the upstream — including no response at all (connection refused). 504 Gateway Timeout means the upstream started responding but took too long. Dangling routes to stopped services produce 502, not 504.