How to diagnose a failed proxy tunnel

Chrome's ERR_TUNNEL_CONNECTION_FAILED means its Hypertext Transfer Protocol Secure (HTTPS) tunnel did not open.

Run curl through the configured proxy and inspect %{http_connect}: a 200 response confirms the tunnel, while 407 identifies a proxy authentication challenge. A successful tunnel still does not prove the target page works.

Prerequisites

• curl 8.7.1 from the official download page.
• A permitted HTTPS target and trusted, credential-free Hypertext Transfer Protocol (HTTP) proxy endpoint.

Warning: This probe can consume paid proxy traffic. Start with a test allocation and authorized HTTPS target; check quota first and stop if charges are unexpected. Keep credentials out of PROXY_URL and use production routes only under the approved procedure.

Reproduce outside the browser

These commands use Bash or Zsh on macOS/Linux. Replace <PROXY_HOST> and <PROXY_PORT> with the operator's trusted, credential-free HTTP endpoint:

export PROXY_URL='http://<PROXY_HOST>:<PROXY_PORT>'

Run the probe in that same terminal. It stops with a setup message if PROXY_URL is missing.

: "${PROXY_URL:?Set PROXY_URL to http://host:port}"
curl --disable --proxy "$PROXY_URL" --noproxy '' \
  --connect-timeout 10 --max-time 25 \
  --silent --show-error --output /dev/null \
  --write-out 'target=%{response_code} connect=%{http_connect}\n' \
  'https://example.com/'

The exact command produced these results with curl 8.7.1 and task-owned local proxies:

Successful tunnel: target=200 connect=200
Authentication challenge: target=000 connect=407

The successful case reached example.com with normal TLS verification and exited 0. The challenge fixture returned 407, and curl exited 56. These checks demonstrate output interpretation; they do not verify an external provider or authenticated production route.

With an HTTP proxy, the CONNECT exchange precedes the destination's HTTPS response. connect=407 means the proxy requires authentication; use the 407 guide, not the destination login.

A connect=200 followed by a destination failure points farther along the route. A timeout or refusal before a CONNECT code can indicate an unreachable endpoint, wrong host or port, network restriction, or protocol mismatch.

connect=000 can also occur with SOCKS or a non-CONNECT request. Verify the proxy scheme before interpreting it.

Check browser-specific differences

If curl works, inspect the browser's proxy setting and bypass rules. Verify the HTTPS hostname and port, then retry in a clean profile. Do not put a credential-bearing URL in Chrome launch arguments.

Profile tools have their own proxy fields; a terminal environment variable does not necessarily configure them.

If both clients fail at CONNECT, inspect the proxy authentication method, account or IP allowlist, and permitted destination ports. RFC 9110 defines CONNECT as a request to establish a tunnel; proxies may restrict its destination.

When contacting the operator, preserve the status and a redacted error line. Do not share verbose logs containing credentials or private target URLs.

Once a fixed target loads, test the approved destination separately. A successful tunnel does not make a target page accessible or yield correct records.

ProxyLaneTraffic never expires

Premium residential proxies
From $2/GB

Scale your workflows with the tools you already use. Rotating or sticky sessions up to 72 hours.

Try 350 MB for $1.95 View plans