How to find why a proxy connection times out

One request is a diagnosis, not an availability measurement. Repeat with the same target, route, and limits before drawing a conclusion.

Read a proxy error page about a TCP timeout

Some proxies return their own error page, for example: "The proxy failed to connect to the web server, due to TCP connection timeout". The proxy wrote that page, so the client reached the proxy. The hop that timed out is the proxy's connection to the target.

Check in this order:

1. Open the target without the proxy, or through another permitted route, to see whether the site answers at all.
2. Check the target host and port in the request. A wrong port or an unreachable internal hostname produces the same message.
3. Ask the proxy operator whether the exit can reach that destination. Firewalls, blocked ports, and gateway problems on the proxy side end the same way.

If the target answers through other routes, send the proxy operator the time in UTC, the target host, and the exact error text through a proxy support ticket.

Run one bounded probe

Use curl 8.7.1, tested on macOS 26.5.2. The command assumes a no-auth or IP-allowlisted route. Set PROXY_URL to the proxy scheme, host, and port without credentials, and TARGET_URL to one permitted HTTPS URL. Load any credentials through a private runtime binding rather than the URL or command line.

: "${PROXY_URL:?Set PROXY_URL without credentials}"
: "${TARGET_URL:?Set TARGET_URL to one permitted HTTPS URL}"

curl --disable --proxy "$PROXY_URL" --noproxy '' \
  --connect-timeout 5 --max-time 20 \
  --silent --show-error --output /dev/null \
  --write-out 'status=%{response_code} proxy=%{http_connect} dns=%{time_namelookup}s connect=%{time_connect}s appconnect=%{time_appconnect}s pretransfer=%{time_pretransfer}s first_byte=%{time_starttransfer}s total=%{time_total}s\n' \
  "$TARGET_URL"

--connect-timeout caps connection setup, including DNS and the TCP and TLS handshakes; --max-time caps the whole transfer. The values are diagnostic bounds, not provider recommendations or a job deadline.

Two lines captured through a local test proxy show both outcomes. A completed transfer:

status=200 proxy=200 dns=0.000054s connect=0.000281s appconnect=0.148282s pretransfer=0.148346s first_byte=0.230357s total=0.230488s

A proxy address that never answers:

curl: (28) Failed to connect to 10.255.255.1 port 3128 after 5004 ms: Timeout was reached
status=000 proxy=000 dns=0.001954s connect=0.000000s appconnect=0.000000s pretransfer=0.000000s first_byte=0.000000s total=5.004832s

In the second run, connect stayed at zero and total equals the 5-second connect limit: the TCP connection to the proxy never completed. Those timings come from a local test and are not a provider baseline.

Map the last completed phase

curl's --write-out fields are cumulative times from the start of the transfer, so read them as ordered milestones.

The route scheme matters: with an HTTPS proxy, TLS can happen with the proxy, with the target after CONNECT, or at both boundaries. time_starttransfer - time_pretransfer estimates the wait after setup and before the first byte. It includes network delay, proxy work, and target queues, so it is not a direct measure of server processing.

A zero or absent field can mean the phase did not apply or never completed; do not name a failed hop from that alone. An HTTP 407 is a proxy authentication response, and a 429 comes from whichever HTTP layer sent it. Identify that layer before waiting, stopping, or changing configuration.

Choose the next check

Change one factor at a time and keep the target, method, route, and timeouts the same, so the next result stays comparable. Stop when the target asks clients to slow down or denies access; switching exits to evade that changes the measurement and can break the source's access terms.

Separate a browser timeout from network evidence

A Playwright timeout applies to the awaited operation. A page.goto() timeout does not show whether connection setup, the target response, page scripts, or the readiness condition used the time. Record the operation, URL host, last request or response event, and timeout setting, without tokens or credential-bearing URLs.

Reduce the reproduction to one context, one target, one route, and one awaited action. A clean profile removes extension and cache effects but does not turn a browser timeout into a provider measurement.

Tell a client timeout from an Nginx proxy timeout

The same words describe a different setup: Nginx as a reverse proxy in front of an application. There, Nginx is the waiting client. It stops waiting for the upstream application and can return a 504 Gateway Timeout.

A 504 alone does not separate the cases, because a forward proxy can return it too. Check which server wrote the error. The Nginx error log records "upstream timed out" and names the waiting phase; the Nginx upstream module source defines those strings.

For an endpoint that should answer quickly, raising these values hides the slow response instead of locating it. Check the upstream application first: its log, the duration of the affected request, and whether it accepts connections. Long polling and streaming endpoints can need a longer proxy_read_timeout; set it for that location only.

ProxyLaneTraffic never expires

Premium residential proxies
From $2/GB

Scale your workflows with the tools you already use. Rotating or sticky sessions up to 72 hours.

Try 350 MB for $1.95 View plans