What Is ERR_TUNNEL_CONNECTION_FAILED? – Causes and Fixes

Troubleshooting P2 what is err_tunnel_connection_failed

Learn what ERR_TUNNEL_CONNECTION_FAILED means, how HTTPS proxying via CONNECT works, and which proxy misconfigurations produce this error.

This error appears when a client is configured to use a proxy and the proxy could not establish the tunnel needed for an HTTPS request. The failure is between client and proxy, or proxy and destination — never at the destination alone.

1. How HTTPS Through a Proxy Works

An HTTP proxy cannot read encrypted traffic, so for HTTPS the client asks it to open a tunnel:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443
Proxy-Authorization: Basic <credential>

The proxy opens a TCP connection to the destination and then relays bytes blindly. TLS is negotiated end to end through that tunnel. ERR_TUNNEL_CONNECTION_FAILED means this step did not complete.

2. Common Causes

Cause	Detail
Proxy unreachable	Wrong host or port, or the service is down
Authentication failed	Missing or malformed credentials for the proxy
CONNECT not permitted	The proxy allows plain HTTP but forbids tunnelling
Destination port blocked	Proxy policy restricts which ports may be tunnelled
Destination unreachable from the proxy	The proxy's own network cannot reach the target
Stale configuration	A proxy setting left behind by a VPN or corporate profile

Stale configuration is the most common cause on a personal machine: a proxy that no longer exists is still configured.

3. Diagnosing It

curl -sv -x "http://user:[email protected]:8000" https://example.com/ 2>&1 | head -25

The verbose output shows the CONNECT and the proxy's answer. A 407 means credentials; a 403 means policy; a hang means the proxy cannot reach the destination or is not listening.

Then test the proxy itself: can you open a TCP connection to its host and port at all?

4. Fixing It

Check the proxy settings. Remove leftovers from a removed VPN or profile; on a personal machine, the correct value is usually none.
Verify host and port and that the service is running.
Supply correct credentials, percent-encoding reserved characters.
Confirm CONNECT is allowed for the destination port; many proxies permit only 443.
Test the destination from the proxy's network, since the proxy may be the one without reachability.
Check TLS interception. Inspecting proxies need their certificate trusted, or the tunnel fails at handshake.

5. In Automated Clients

The same failure surfaces as a proxy or tunnel exception. Two habits make it quick to diagnose:

Log the proxy host and port, never the credential, so the failing endpoint is identifiable.
Test the proxy against a known-good destination before blaming the target site.

For rotating pools, a single endpoint failing to tunnel while others succeed means that endpoint is unhealthy, not that the target is blocking.

ERR_PROXY_CONNECTION_FAILED — the client could not reach the proxy at all.
407 — the proxy demands authentication; the tunnel was refused for credentials.
ERR_CONNECTION_TIMED_OUT — no proxy involved, destination silent.
ECONNREFUSED — nothing listening at the address attempted.

7. Real-World Examples

A laptop keeping a corporate proxy setting after leaving the office network.
A rotating proxy endpoint whose credentials were rotated in one worker only.
A proxy permitting HTTP but not CONNECT, so plain sites load and HTTPS fails.
An inspecting proxy whose certificate is not trusted by the client.

8. Summary

ERR_TUNNEL_CONNECTION_FAILED means the CONNECT tunnel an HTTPS request needs could not be established through the configured proxy — because the proxy is unreachable, unauthenticated, restricted by policy, or unable to reach the destination.

Diagnose by exercising the proxy directly with verbose output, and start by checking whether a proxy should be configured at all.