The proxy was reached but would not open a tunnel to the site: how to read the status and fix it.
To open an HTTPS site through an HTTP proxy, Chrome first asks the proxy to open a tunnel with a CONNECT request, then runs the TLS exchange through it. RFC 9110 says that any 2xx answer starts the tunnel and any other answer means the tunnel has not been formed. ERR_TUNNEL_CONNECTION_FAILED is Chrome's name for that second case.
So the proxy answered, but not with a yes. Which answer it gave is the key clue, and Chrome does not show it. A command-line test does.
| Item | What Chrome means | Where to look first |
|---|---|---|
| ERR_PROXY_CONNECTION_FAILED (-130) | Could not create a connection to the proxy server | Host, port, firewall, system proxy settings |
| ERR_TUNNEL_CONNECTION_FAILED (-111) | A tunnel through the proxy could not be established | The status the proxy answered to CONNECT: login, rules, reach |
| ERR_PROXY_AUTH_REQUESTED (-127) | The proxy requested authentication for the tunnel | The sign-in prompt and the saved login |
| ERR_PROXY_CERTIFICATE_INVALID (-136) | An HTTPS proxy presented an invalid certificate | Whether the proxy is really an HTTPS proxy |
Source: Chromium net_error_list.h, read on 15 November 2026. For -130, see the separate guide on ERR_PROXY_CONNECTION_FAILED.
1. The proxy did not accept the login. It answers the CONNECT with 407. Chrome shows a sign-in prompt for an HTTP proxy, but it does not use a username and password written into its proxy settings or into --proxy-server, and it supports no login at all for SOCKS5. A proxy that needs a login and receives none leaves the tunnel unformed.
2. The protocol or port does not match. Chrome expects an HTTP proxy at the address you gave. On Proxy302 the gateway ports are HTTP 2222 and SOCKS5 3333, and each static IP has one protocol, chosen at purchase. A credential generated as HTTP can fail over SOCKS5, so check which one your asset is.
3. The proxy refused or could not reach the site. A 403 means the proxy understood the request and refuses it, which can come from a rule, an IP whitelist or an ended lease. A 502 or 504 means the proxy itself got an invalid answer or no timely answer from the site, so look at the IP or the site, not at your login.
# HTTP proxy: show the CONNECT step
curl -v -m 20 -x http://LOGIN:PASSWORD@HOST:PORT https://ipinfo.io/json
# A refused tunnel ends with a line like this (here the proxy answered 407):
# curl: (56) CONNECT tunnel failed, response 407
# A working tunnel prints the exit IP, country and network as JSON.
# Same test over SOCKS5 (DNS is resolved by the proxy)
curl -v -m 20 -x socks5h://LOGIN:PASSWORD@HOST:PORT https://ipinfo.io/jsonExample only: replace LOGIN, PASSWORD, HOST and PORT with the values from My assets. On Windows PowerShell use curl.exe. The 407 line was reproduced against a local test proxy.
Run the curl -v command above with the same host, port and login Chrome uses.
Expected result Either the exit IP as JSON, or a line such as CONNECT tunnel failed, response 407.
407 is the login, 403 is a rule or whitelist or ended lease, 502 and 504 point at the IP or the site, and a timeout or reset points at the address, port or protocol.
Copy USERNAME and PASSWORD again from My assets. In Chrome use an HTTP proxy and answer the sign-in prompt, or use an extension that stores the login.
HTTP uses port 2222 and SOCKS5 uses port 3333 on the gateway. For Chrome pick an HTTP asset; Chrome supports no login for SOCKS5.
Open My assets: is the lease still running, is there traffic left, is an IP whitelist on? A failed asset is reissued after a ticket with the order number.
If curl works for one site and not another, the problem is that site's path, not your setup. If curl works and Chrome still fails, look at the system proxy settings, extensions and policies.
Check Is the login in the URL complete, with special characters encoded?
Fix Copy USERNAME and PASSWORD from My assets again and retest.
Stop when If a fresh copy still gives 407, open a ticket with the order number.
Check Is the lease running, and is an IP whitelist on that does not include your current public IP?
Fix Fix the whitelist or renew the asset, then retest.
Stop when Do not keep retrying a 403; it is a refusal, not a glitch.
Check Does the same IP reach other sites?
Fix Test another site; if only one site fails, the problem is on that path.
Stop when If every site fails on one IP, open a ticket with the order number so the asset can be reissued.
Check Does Chrome use another proxy: an extension, a policy or a --proxy-server flag?
Fix Check the system proxy settings, chrome://extensions and chrome://policy, and use an HTTP asset.
For a browser, buy a static ISP IP with the HTTP protocol (port 2222), because Chrome supports no login for SOCKS5. Copy HOST, PORT, USERNAME and PASSWORD from My assets, enter them in the browser, and confirm the exit at https://ipinfo.io/json.
A static ISP IP costs US$0.50 for one day and US$7.99 for 30 days, about US$0.27 a day (7.99 / 30), the same in every country. Availability changes daily and is shown on the order page. There is no free trial, and the smallest purchase is one IP for one day. A failed asset is fixed by reissuing it after a ticket with the order number.
Chrome reached the proxy, but the proxy did not agree to open a tunnel to the website. Any CONNECT answer other than 2xx leaves the tunnel unformed.
ERR_PROXY_CONNECTION_FAILED (-130) means the connection to the proxy itself could not be created. ERR_TUNNEL_CONNECTION_FAILED (-111) means the proxy was reached but a tunnel through it could not be established.
It can: the proxy answers the CONNECT with 407. Chrome normally shows a sign-in prompt for an HTTP proxy, and it does not use a login written into the proxy settings or the --proxy-server flag.
Not in Chrome: the Chromium notes say no authentication methods are supported for SOCKS5. Use an HTTP proxy for the browser.
Run curl -v -x http://LOGIN:PASSWORD@HOST:PORT https://ipinfo.io/json. A refused tunnel prints a line such as CONNECT tunnel failed, response 407.
Fixed static ISP proxies: a residential-grade IP that stays the same for the whole term. For social accounts, stores and AI tools. HTTP and SOCKS5.
View options and pricingThe ERR_PROXY_CONNECTION_FAILED error appears in Chrome and Edge when the browser cannot establish a connection with a proxy server.
HTTP 407 Proxy Authentication Required comes from the proxy server, not from the website you are trying to reach.
Set a proxy in Google Chrome: system settings, the --proxy-server flag, why SOCKS5 with a login does not work, extensions and a check.
Why SwitchyOmega keeps asking for a proxy username and password or returns 407: save credentials in the profile, use HTTP, check the IP with curl.
Official documentation · Confirmed on:
Read on 15 November 2026: TUNNEL_CONNECTION_FAILED (-111) is a tunnel connection through the proxy that could not be established; PROXY_CONNECTION_FAILED (-130) is a connection to the proxy server that could not be created and does not include failures during the CONNECT method; PROXY_AUTH_REQUESTED (-127) is the proxy requesting authentication for tunnel establishment; PROXY_CERTIFICATE_INVALID (-136) is an invalid certificate from an HTTPS proxy.
Official documentation · Confirmed on:
Read on 15 November 2026: for HTTPS requests through an HTTP proxy the TLS exchange is forwarded through the proxy using the CONNECT method; HTTP proxies support Basic, Digest, Negotiate and NTLM authentication, but Chrome does not use credentials embedded in the proxy settings; no authentication methods are supported for SOCKSv5 in Chrome; --proxy-server accepts URIs such as http://foo:8080 or socks5://mysocks:1080.
Official documentation · Confirmed on:
Read on 15 November 2026: section 9.3.6 says any 2xx response to CONNECT means the connection switches to tunnel mode and any other response means the tunnel has not been formed, and that proxy authentication may be used to establish the authority to create a tunnel; 403 means the server understood the request but refuses it; 407 means the client must authenticate to use the proxy; 502 means a gateway or proxy got an invalid response from the server it contacted; 504 means it got no timely response.
Local example · Confirmed on:
Run on 15 November 2026: curl -x through a local test proxy that answers every CONNECT with 407 printed "curl: (56) CONNECT tunnel failed, response 407", with and without a login in the proxy URL.
Product observation · Confirmed on:
Product facts file of the site, checked 15 November 2026: gateway ports HTTP 2222 and SOCKS5 3333; each static IP has one protocol; a credential generated as HTTP can fail over SOCKS5 and the fix is a new credential generated as SOCKS5; failed assets are reissued after a ticket with the order number.
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.
