Behind ERR_TUNNEL_CONNECTION_FAILED: reading the proxy's CONNECT reply

Likely causes, ranked

• A script launches Chrome without credentials. The --proxy-server flag carries host and port only; any user:pass you put there is dropped. Puppeteer or Selenium in headless mode then receives a 407 and reports it as a tunnel failure.
• An app behind a Wi-Fi proxy that needs a password. Apps have no login prompt, so their HTTPS requests fail even though the phone's browser works.
• The proxy cannot reach the destination. It answers the CONNECT with 502. The 502 Bad Gateway page goes deeper into that case.
• Only certain sites fail. The destination is down or refusing, while the same proxy opens other sites without trouble.

What we saw in testing

We triggered both common cases on a test proxy, rewritten below as 203.0.113.10:8080 with the login user123:pass456. In each row Chrome displayed the same message, which is why it tells you so little on its own.

Recover the hidden status code

Run curl -v -x http://user123:[email protected]:8080 https://example.com with your own proxy values and read the reply that follows > CONNECT example.com:443 HTTP/1.1. A 407 sends you to the 407 guide. A 502 points at the destination or the route beyond the proxy.

Prefer not to open a terminal? The proxy checker reports the same two situations as auth failed (407) and HTTP 502.

Note that an ordinary, visible Chrome window handles a 407 differently: it shows a sign-in box for the proxy username and password instead of the tunnel error. That is why 407-driven tunnel errors mostly appear in automation and in apps that cannot prompt.

Fixes for each environment

• Puppeteer: launch with --proxy-server=http://host:port, then call page.authenticate({ username, password }) before the first navigation. A full example is in the Puppeteer proxy guide.
• Playwright: give proxy: { server, username, password } in the launch options; Playwright answers the 407 by itself. See Playwright setup.
• Selenium: Chrome will not accept user:pass on its command line. The Selenium guide lists approaches that work.
• Desktop Chrome on Windows: when the sign-in box never shows up, an extension may be blocking it. Try again in a window with extensions disabled.
• Phones: apps that need an authenticated proxy work best through a proxy app that supports user:pass, as described in the Android setup guide.

Step by step

1. 1

   Find out what the proxy answered

   Use curl -v -x with your proxy line, or the checker, to see whether the reply to CONNECT is 407 or 502.

2. 2

   407: hand over credentials correctly

   In automation, use the library's authentication feature rather than placing user:pass inside --proxy-server.

3. 3

   502: test a different destination

   Open a large, stable site such as example.com through the same proxy. If it loads, the original site is the problem.

4. 4

   Confirm the exit IP

   When the tunnel opens, load my IP in that same browser to check traffic really leaves through the proxy.

Frequently asked questions