Fixing ERR_TUNNEL_CONNECTION_FAILED with a proxy

Two cases we reproduced

Both ran against a test proxy, rewritten here with the documentation address 203.0.113.10:8080 and user123:pass456. In a normal Chrome window the 407 case does not become a tunnel error; Chrome opens a sign-in dialog for the proxy username and password instead. Tunnel errors caused by a 407 therefore show up mostly in automation tools and in apps that cannot prompt for a password.

Causes, most likely first

• An automation script sends no credentials. Chrome's --proxy-server flag accepts host and port only, not user:pass. Headless Puppeteer or Selenium gets a 407 and reports a tunnel failure.
• A phone app behind a password-protected Wi-Fi proxy. The app has no login dialog, so HTTPS breaks while the browser still works.
• The proxy cannot reach the target. It returns 502 to CONNECT; the 502 Bad Gateway page covers this in depth.
• Only some sites fail. The destination is blocking or down while other sites work through the same proxy.

Find the real code with one curl command

Run curl -v -x http://user123:[email protected]:8080 https://example.com with your own values. Look at the line right after > CONNECT example.com:443 HTTP/1.1: a 407 means following the 407 guide; a 502 points at the destination or the path behind the proxy. If you prefer not to use a terminal, paste the line into the proxy checker, which reports auth failed (407) or HTTP 502 for the same situations.

Fixes by environment

• Puppeteer: keep --proxy-server=http://host:port at launch and call page.authenticate({ username, password }) before navigating. Full example in the Puppeteer proxy guide.
• Playwright: pass proxy: { server, username, password } when launching the browser and Playwright answers the 407 for you; see Playwright.
• Selenium: Chrome does not take user:pass on the command line; the Selenium guide shows workable options.
• Chrome on Windows: if the sign-in dialog never appears, check whether a proxy extension is suppressing it, then retry in a window without extensions.
• Phones: for apps that need an authenticated proxy, use a proxy app that supports user:pass as in the Android setup guide.

Step by step

1. 1

   Identify the CONNECT response

   Run curl -v -x with your proxy line, or paste it into the checker, to learn whether the proxy returns 407 or 502.

2. 2

   For 407: supply credentials properly

   In scripts, use the library's authentication hook instead of putting user:pass in --proxy-server.

3. 3

   For 502: try another site

   Load a large site such as example.com through the same proxy. If it works, the original destination is the problem.

4. 4

   Re-run and confirm the exit IP

   Once the tunnel opens, visit my IP in that same browser to confirm traffic goes through the proxy.

Frequently asked questions