Fix ERR_TUNNEL_CONNECTION_FAILED in Chrome and Edge

Short answers

What the error means

Chromium defines ERR_TUNNEL_CONNECTION_FAILED, net error -111, as “A tunnel connection through the proxy could not be established.” Chrome and Microsoft Edge share that network code, so both print the same name. When the browser cannot reach the proxy at all, it reports ERR_PROXY_CONNECTION_FAILED instead. Chromium network error list.

Chrome has no specific text for this code, so it shows its generic page: This site can’t be reached and The webpage at … might be temporarily down or it may have moved permanently to a new web address. Those lines are the same for many failures. The code underneath is the evidence: it places the failure at the tunnel step between the browser and the proxy, before any page was requested from the site. Chromium error page strings.

Common causes

The proxy refused CONNECT

Chromium turns every CONNECT answer other than 200 or a 407 challenge into this code, so 403, 502, 503 and any other refusal look the same in the browser. A 403 often means the proxy’s policy does not allow that host, port or account.

A sign-in that was not completed

The proxy asked for credentials with 407 and the sign-in did not finish, for example because the prompt was cancelled. Chromium ends a cancelled prompt for an HTTPS page as this code. Check the complete username and password with the 407 guide.

Wrong port or protocol

A port that does not run an HTTP proxy, such as a SOCKS5 port typed into the HTTP proxy field, will not answer CONNECT with 200. Chromium reports a reply it cannot read as HTTP/1.x as this code; a port that closes or resets the connection without replying gives another connection error. Portproof’s HTTP proxy port is 7000; 7001 is the SOCKS5 port.

The proxy could not reach the site

If the proxy cannot resolve or connect to the site, it answers with an error such as 502 or 504.

No exit device for the requested country

On Portproof, 502 E_NO_STOCK_COUNTRY means no device is online for the requested pool and country right now. Choose another country or check current locations.

Port or host restrictions

A proxy can refuse tunnels to some hosts or ports by policy, often with 403. An HTTPS site on a non-standard port, such as 8443, is a common case. Ask the proxy’s operator which destinations its policy allows.

A different proxy than you expect

A VPN app, security software, an extension or a work policy can set its own proxy. Its rules, not the proxy you configured, may be refusing the tunnel. The next section shows how to see the proxy Chrome actually uses.

Find the proxy Chrome is using

1. Open chrome://settings/system. Open your computer's proxy settings means Chrome follows Windows or macOS. Chrome is using proxy settings from an extension or Chrome is using proxy settings from your administrator names the source that takes precedence.
2. Open chrome://net-internals/#proxy. In Chrome 158 and later it lists the effective proxy settings of the current profile, and the original settings when they differ. Earlier versions, and Edge before 158, show only the Re-apply settings and Clear bad proxies buttons; read the source from step 1, or record a NetLog (below), whose Proxy view shows the settings.
3. On a managed device, open chrome://policy and look for proxy policies such as ProxySettings. Send what you find to the administrator instead of working around it.
4. Open chrome://version and read the command line. A --proxy-server switch there overrides the system settings for that launch.

Microsoft Edge uses the same checks with edge:// addresses, such as edge://settings/system, edge://policy and edge://net-export. Microsoft’s Edge proxy support article describes the same configuration sources. The proxy settings guide explains manual, PAC and automatic modes.

Read the proxy’s answer with curl

The browser hides the CONNECT status; curl -v -x prints it. Send the same proxy one HTTPS request from the same computer, to the failing page’s https://host:port/ where you are allowed to test it; the example uses example.com. In an interactive terminal, replace the username with the complete one from the connection builder; curl then asks for the password. With another provider, use the host, port and credentials it issued.

curl --disable -sS -v --noproxy '' \
  --connect-timeout 5 --max-time 15 \
  -o /dev/null \
  -x "http://gw.portproof.org:7000" \
  --proxy-user "YOUR_FULL_PROXY_USERNAME" \
  https://example.com/

Lines starting with > are what curl sent to the proxy; lines starting with < are the proxy’s answer. This excerpt comes from a local test proxy that refuses every CONNECT with 403, and no credentials were sent:

* Establish HTTP proxy tunnel to example.com:443
> CONNECT example.com:443 HTTP/1.1
> Host: example.com:443
> User-Agent: curl/8.7.1
> Proxy-Connection: Keep-Alive
>
< HTTP/1.1 403 Forbidden
< Content-Length: 0
< Connection: close
<
* CONNECT tunnel failed, response 403
* Closing connection
curl: (56) CONNECT tunnel failed, response 403

curl’s own wording, CONNECT tunnel failed, response 4xx, has its own guide, including why the number before the message differs between curl releases. curl and the browser can still disagree if they use different proxies, so confirm that the host and port in your command match what chrome://net-internals/#proxy (Chrome 158 and later) or the NetLog Proxy view shows.

Fixes on Windows, macOS and the Chrome command line

Windows 10 or 11

Open Settings > Network & internet > Proxy. Automatically detect settings, Use setup script and Manual proxy setup can each select a proxy. Correct the address and port of a proxy you use, or turn off an entry you added and no longer need. Leave settings your organisation manages in place.

macOS

Open System Settings > Network, select the active network service, then Details > Proxies. Check Web proxy (HTTP) and Secure web proxy (HTTPS) against your proxy’s details, or turn off an entry you no longer use.

Chrome command-line flags

Proxy flags are launch switches, not settings pages. --proxy-server="http://host:port" overrides the system settings for that launch, and --no-proxy-server makes direct connections. Close every Chrome window first (chrome://quit), then confirm the switch in chrome://version. A proxy policy set by an administrator overrides these switches.

An extension controls the proxy

Turn the extension off or correct its proxy entry, then reload. If it stores the proxy credentials, check them there; the Chrome extension guide covers that setup.

Credentials for an authenticated proxy

Chromium does not use a username or password written into manual proxy settings, and it supports no SOCKS5 authentication. Use the HTTP endpoint and enter the proxy credentials in the browser’s sign-in dialog or a trusted extension. Chromium proxy documentation.

A work or school proxy

Send the administrator the exact code, the time and the proxy source shown in chrome://settings/system. Its policy may refuse the destination by design.

If you never meant to use a proxy, remove the entry from whichever source chrome://settings/system named, then reload one page. After any change, select Re-apply settings in chrome://net-internals/#proxy and test one small HTTPS page before reopening the tabs you need.

Record a NetLog when curl is not enough

When curl succeeds and the browser still fails, record what the browser itself did. Chromium’s instructions use chrome://net-export. The log covers all of Chrome’s network activity while it runs, so close tabs you do not need first.

1. Open chrome://net-export in a new tab and leave the log mode at its default.
2. Select Start Logging to Disk.
3. Reproduce the failing page once, in a different tab. Closing the net-export tab stops logging.
4. Return to the net-export tab and select Stop Logging.

In the log, the event HTTP_TRANSACTION_READ_TUNNEL_RESPONSE_HEADERS holds the status line the proxy returned to CONNECT, and the Proxy view shows the settings in effect when the capture ended. Open the file in the NetLog viewer or send it to whoever runs the proxy. The default mode makes a best-effort attempt to strip cookies and credentials, but the log still lists the hostnames and URLs visited and your proxy configuration, so review it before sharing. Chromium NetLog instructions.

What to send support

Send the UTC time, browser name and version, the exact code, the proxy source shown in chrome://settings/system, the proxy host and port without credentials, the destination hostname and the < status line from curl. The CONNECT tunnel guide has a report template you can fill in. Leave out passwords, API keys, verbose traces and URLs that contain tokens.

What is not allowed

Test only sites and proxies you are permitted to use, for work such as QA, price monitoring, ad verification and market research. A working tunnel does not grant access to a website; respect each site’s terms and rate limits. See the acceptable-use policy.

Read next