ERR_PROXY_CONNECTION_FAILED and ERR_TUNNEL_CONNECTION_FAILED: What Each Means and How to Fix It

Chrome's error page for the first one reads *There is something wrong with the proxy server, or the address is incorrect*. The second often lands on a generic *This site can't be reached* screen with the code at the bottom. Either way, the code is the useful part.

Which error you have, and what it tells you

The distinction is about which leg of the journey broke. Leg one is your machine to the proxy; leg two is the proxy to the website. ERR_PROXY_CONNECTION_FAILED is always leg one. ERR_TUNNEL_CONNECTION_FAILED is always leg two, which is why re-checking a host and port that were correct all along wastes an afternoon.

The ten-second test

Before changing anything in Chrome, take the browser out of the picture. The same proxy through cURL, with verbose output, shows exactly what the proxy said.

curl -v -x http://USERNAME:PASSWORD@PROXY_HOST:PROXY_PORT https://example.com -o /dev/null

# Windows PowerShell: use curl.exe, not the curl alias
curl.exe -v -x http://USERNAME:PASSWORD@PROXY_HOST:PROXY_PORT https://example.com -o NUL

Every exit code cURL can return here is covered in cURL proxy errors.

Fixing ERR_PROXY_CONNECTION_FAILED

If you meant to use a proxy

1. 1Check the port. A wrong port is the most common cause by a wide margin — HTTP and SOCKS5 usually listen on different ports, and pasting one into the other fails here.
2. 2Check the protocol field. A SOCKS5 endpoint entered as an HTTP proxy, or the reverse, fails before any handshake.
3. 3Check the host. A typo in a gateway hostname produces Could not resolve proxy in cURL and this error in Chrome.
4. 4Allow outbound traffic on the proxy port. Office networks, school networks and some antivirus firewalls block unusual ports. Try a mobile hotspot to confirm.
5. 5Confirm the plan is active. An expired or exhausted plan can close the listener rather than returning an error page.

If you did not set a proxy

Then something set one for you, and it is now pointing at an address that does not answer. Uninstalled VPN clients, ad blockers and adware are the usual suspects. Turn the system proxy off first:

• Windows 10/11 — Settings → Network & internet → Proxy. Turn off Use a proxy server under Manual proxy setup, and turn off Use setup script unless your organisation requires it.
• macOS — System Settings → Network → your connection → Details → Proxies. Untick everything you did not deliberately enable.
• Chrome — open chrome://extensions and disable anything that mentions proxy, VPN or privacy, then reload.
• Managed devices — open chrome://policy and look for ProxyServer, ProxyMode or ProxyPacUrl. A policy overrides every other setting and has to be changed where it was set.

chrome://net-internals/#proxy shows the proxy configuration Chrome is actually using right now, which is often not the one you think you set.

Fixing ERR_TUNNEL_CONNECTION_FAILED

The proxy is alive. Your job is to find out why it declined to open the tunnel, and the cURL status line above has already told you.

• 407 — authentication. Chrome does not accept credentials in --proxy-server, so an automated browser never sends them. Either whitelist your IP or handle the challenge in code — see 407 Proxy Authentication Required.
• Whitelist drift. If you authenticate by IP, check that your public address has not changed after a router restart or a VPN toggle. Our IP tool shows the address the proxy sees.
• 403 or 405 — destination refused. Some proxies only tunnel to port 443, or block specific domains. Try a plain, neutral site; if that works, the proxy is filtering the one you wanted.
• 502 or 503 — upstream failure. The proxy could not reach the site through its exit. Retry on a different exit or session; if every exit fails for one domain, the site is down or blocking that network.
• Filtering software. Antivirus web shields, parental controls and school filters act as local proxies and refuse tunnels to sites they block. If only some sites fail, look there.

In automation: Selenium, Puppeteer and Playwright

Headless browsers produce the same codes, usually wrapped in an exception such as net::ERR_TUNNEL_CONNECTION_FAILED. In automation it is almost always the credentials: Chromium drops the user:pass@ part of a --proxy-server URL without warning, the proxy answers 407, and the browser reports a tunnel failure.

• Playwright accepts username and password in the proxy option and handles the challenge for you — see Playwright proxies.
• Puppeteer needs page.authenticate() before the first navigation — see Puppeteer proxy authentication.
• Selenium has no built-in answer; whitelisting or a local forwarder is the reliable route — see Selenium proxy authentication.

If nothing above helped

1. 1Open a Guest window. If it works there, an extension or profile setting in your main profile is the cause.
2. 2Reset network state on Windows with netsh winsock reset and ipconfig /flushdns from an elevated prompt, then reboot.
3. 3Capture a log at chrome://net-export, reproduce the error once, and open it in the Netlog viewer. The failing CONNECT and the proxy's exact reply are in there.
4. 4Send the proxy provider the timestamp, your public IP and the cURL output. That is enough for support to find the request on their side.