What ERR_TUNNEL_CONNECTION_FAILED Really Means
To reach an HTTPS site through an HTTP proxy, Chrome first sends a CONNECT request asking the proxy to open a TCP tunnel to the target on port 443, then runs TLS through it. The proxy answers 200 when the tunnel is up.
Chromium's http_proxy_client_socket.cc handles that answer three ways: 200 is success, 407 is an authentication challenge, and every other status becomes ERR_TUNNEL_CONNECTION_FAILED. Chrome also discards the proxy's response body on purpose, so a 403 page explaining the block never reaches you.
The keyword here is proxy. Chromium's net error list keeps a separate code, ERR_PROXY_CONNECTION_FAILED, for a proxy it cannot reach at all, so a tunnel failure means the proxy was reached and said no. Local DNS is not the cause either, since Chrome lets the proxy resolve hostnames when an HTTP proxy is in use.
How to Diagnose ERR_TUNNEL_CONNECTION_FAILED
Get the Real Status Code First
Chrome hides the proxy's answer, but curl shows it:
curl -v -x http://USER:PASS@HOST:PORT https://httpbin.org/ipA failed tunnel prints CONNECT tunnel failed, response 403. A 403 means the proxy refused you by policy: your IP is not whitelisted, the account is empty, or the port is blocked. A 502, 503, or 504 means the proxy let you in but could not reach the target, usually proxy-side DNS or an upstream outage. A 407 means the credentials were rejected.
If curl works and Chrome still fails, open chrome://net-internals/#proxy to see which proxy Chrome really uses, then click Re-apply settings and Clear bad proxies.
Check What Is Setting the Proxy
Chrome uses the operating system's proxy settings unless a flag, extension, or enterprise policy overrides them. VPN clients and antivirus suites often leave a proxy behind. On Windows, run inetcpl.cpl, open Connections > LAN settings, and clear any server you did not add. On macOS, the same list lives under System Settings > Network, inside the Proxies tab of your active connection.
Then check chrome://policy for a managed proxy entry and chrome://extensions for anything controlling proxies. This matters more than it sounds: if a policy set the proxy, the fix on a work laptop is a ticket to the admin, not a settings tweak.
How to Fix ERR_TUNNEL_CONNECTION_FAILED
Authenticated Proxies: Credentials, Whitelists, and Ports
With paid residential proxies or datacenter proxies, the tunnel error almost always means the proxy rejected the CONNECT for account reasons. One thing worth knowing: Chromium ignores any username and password embedded in a proxy address. Put user:pass@host:port in the system settings or a --proxy-server flag and Chrome silently drops the credentials.
So check the things that produce a 403: your current public IP is on the provider's whitelist, the port matches the product you bought, and the credential string has no trailing spaces. The proxy formatter tool rebuilds the address in the exact syntax each client expects.
Also Read: How to Fix Proxy Authentication Error 2606
Antivirus and Filtering Gateways
Security software that inspects HTTPS traffic can break the CONNECT handshake. Opera users hit this in 2024 when a Kaspersky update began scanning the browser's built-in VPN, which is a browser-level proxy. The fix was excluding opera.exe from encrypted traffic scanning, and the same applies to Chrome under any suite with HTTPS inspection.
Corporate gateways are the other source. Many allow CONNECT only to port 443, so an internal tool on port 8443 fails while normal sites load. Broadcom's Cloud SWG documentation logs this as connect_method_denied, and the fix lives in the gateway policy, not in the browser.
Selenium, Puppeteer, and Playwright
Headless browsers inherit every rule above, plus one that bites PAC users. Since Chrome 67, a failed CONNECT no longer triggers proxy fallback, so PROXY a:8080; DIRECT will not drop to a direct connection when proxy a rejects the tunnel. Pass credentials through page.authenticate() in Puppeteer or the proxy option in Playwright, and test the exact proxy string with curl first.
Also Read: Plug Proxyon Into Puppeteer
FAQ Section
Is ERR_TUNNEL_CONNECTION_FAILED a DNS problem?
Not on your machine. With an HTTP proxy configured, Chrome sends the hostname to the proxy and lets it resolve the name. If the proxy cannot resolve it, the proxy returns an error to the CONNECT and Chrome reports a tunnel failure. Changing your local DNS server will not change that.
Why does it only happen on HTTPS sites?
CONNECT is only used for HTTPS. Plain HTTP requests are forwarded to the proxy as normal GET requests, so a proxy that blocks tunnels can still serve HTTP pages, which makes the error look random.
Does the error appear in Edge, Opera, and Brave?
Yes. They are all built on Chromium and use the same network stack and the same error codes, so every fix in this article applies to them.
Can a dead or expired proxy cause it?
A proxy that is completely offline gives ERR_PROXY_CONNECTION_FAILED instead. An expired account on a live proxy server gives the tunnel error, because the server is up and refusing the CONNECT.
Does resetting Chrome fix it?
Only if an extension or a Chrome-level proxy setting caused it. A reset does not touch the operating system proxy, an enterprise policy, or the provider's whitelist, which is where the cause usually is. The same goes for enabling old TLS versions in Internet Options, a step some support threads suggest, and one that does nothing for this error.
Do SOCKS5 proxies produce the same error?
No. SOCKS failures use their own codes, such as ERR_SOCKS_CONNECTION_FAILED. A tunnel error means an HTTP or HTTPS proxy is in the path.
Final Thoughts
ERR_TUNNEL_CONNECTION_FAILED is a proxy telling Chrome no, with the reason stripped out. Run curl against the same proxy to see the actual status code, then work backwards: a proxy you did not set, a whitelist that no longer matches your IP, a port the gateway will not tunnel to, or security software reading encrypted traffic. Most fixes take a minute once the real cause is visible.
