ERR_TUNNEL_CONNECTION_FAILED: Proxy CONNECT Failure Explained

ERR_TUNNEL_CONNECTION_FAILED is a Chrome and Edge error that appears when you are using an HTTP proxy and the proxy declined to create a tunnel to the destination. For HTTPS sites, a browser asks the proxy with a CONNECT example.com:443 request, then runs TLS through the resulting tunnel. If the proxy answers with anything other than a 200, such as 403, 407, 502 or 503, Chrome reports a tunnel failure. Firefox usually says "The proxy server is refusing connections" or "Unable to connect," and Safari says it cannot connect through the proxy.

This is different from ERR_PROXY_CONNECTION_FAILED, where the browser cannot even reach the proxy. Here the proxy is reachable and answers, but says no. Because the proxy decided, the fix is usually in the proxy's rules, credentials or upstream connection, not on the target website.

Identify the proxy's answer

If you know the proxy address, ask it directly:

curl -v -x http://proxy.example.net:3128 https://example.com/ -o /dev/null

Look for the line starting < HTTP/1.1 after the CONNECT request:

If you are a visitor

1. Check whether you intend to use a proxy. In Chrome, open Settings, search for "proxy," and see the system proxy configuration. On Windows run netsh winhttp show proxy; on macOS run networksetup -getwebproxy Wi-Fi and -getsecurewebproxy Wi-Fi.
2. Turn it off if you do not need it. Remove leftover settings from old VPNs, security software or debugging tools (Fiddler, Charles, mitmproxy). Then reload.
3. Enter credentials if prompted. At a school or company, the proxy may need your sign-in. If the prompt never appears, a 407 may be failing silently; sign out and in again.
4. Check the site against the policy. Corporate and school proxies block categories of sites and some ports. Contact the administrator and give them the exact URL and the time.
5. Test the same URL without the proxy. Use mobile data. If it works, the proxy is responsible.
6. Update credentials after a password change. Saved proxy credentials in the operating system keychain may be stale.
7. Try plain HTTP only if the site supports it. If http:// works while https:// fails, the proxy is blocking CONNECT for that destination. Do not rely on this for sensitive data.

If you own or run the proxy

Squid

Squid denies CONNECT to anything but allowed ports. The default configuration includes:

acl SSL_ports port 443
acl CONNECT method CONNECT
http_access deny CONNECT !SSL_ports

If users need a nonstandard HTTPS port such as 8443, add it to SSL_ports. Also check ordering: a http_access deny all placed before your allow rules causes 403 for everything. Validate and reload:

sudo squid -k parse
sudo squid -k reconfigure
sudo tail -f /var/log/squid/access.log

In the access log, TCP_DENIED/403 or TCP_DENIED/407 lines with method CONNECT identify the cause precisely.

Authentication

For a 407, verify that the helper (basic_ncsa_auth, Kerberos, NTLM or LDAP) is working. Test the helper from the command line, and check that clients send credentials for CONNECT, not only for plain requests. Some automated clients send them only after a first rejection.

Upstream connectivity and DNS

A 502 or 503 on CONNECT usually means the proxy itself could not reach the destination: its DNS resolver is failing, its outbound firewall blocks 443, or an upstream parent proxy is down. From the proxy host, run:

dig +short example.com
nc -vz example.com 443

If these fail, fix the proxy host's network. Use the Port Checker to check the destination from outside as well.

TLS inspection

Proxies that intercept HTTPS (SSL bump) must have their CA installed on clients. Without it, you get certificate errors rather than tunnel failures, but misconfigured bump rules can also cause tunnel errors for sites in a "splice" or "terminate" list. Review those rules and see ERR_CERT_AUTHORITY_INVALID for the trust side.

Limits and timeouts

Overloaded proxies refuse new tunnels when connection limits (such as file descriptors) are exhausted. Check ulimit -n, the proxy's max_filedescriptors, and the count of active sockets with ss -s. Also look for idle timeouts shorter than your long-lived HTTPS connections.

Reverse proxies and CDNs

If you run your own forward proxy for server-to-server traffic (for example, an application calling an external API through a proxy), the same rules apply. Node and Python clients show this as tunneling socket could not be established or ProxyError. Check the proxy environment variables (HTTPS_PROXY, NO_PROXY) and make sure internal hosts are excluded. For Node connection errors, see ECONNREFUSED and ENOTFOUND.

Confirm the fix

1. Repeat curl -v -x ... https://example.com/ and confirm HTTP/1.1 200 Connection established followed by a normal response.
2. Fetch the site through a direct connection with the HTTP Status Checker to prove the destination itself works.
3. Check the destination certificate with the SSL Checker.
4. Run the Website Health Check if you also own the site.

Next steps

• Read about ERR_PROXY_CONNECTION_FAILED.
• See the general connection errors guide.
• Review curl error 60 SSL certificate problem for certificate failures through proxies.
• Compare with This site can't be reached.

FAQ

Does ERR_TUNNEL_CONNECTION_FAILED mean the website is down?

Not necessarily. The failure is between your browser and the proxy's attempt to reach the site. Try the site without the proxy to see.

Why does HTTP work but HTTPS fails?

HTTPS requires the CONNECT method, which many proxies restrict. HTTP requests use ordinary proxy GETs, which may be allowed.

What does a 407 mean here?

The proxy wants authentication. Provide credentials, or fix the helper so that CONNECT requests are authenticated properly.

Could malware cause this?

It can, if it installed a local proxy that is no longer running. Scan the computer and reset the proxy settings if you did not configure one.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.