How to Fix Proxy Errors: 407, Tunnel Failed and Timeouts

curl takes your app out of the picture and prints each step of the connection:

curl -v -x http://USER:[email protected]:PORT https://api.ipify.org

If it prints the proxy's address at the end, the proxy works and the problem is in your app. If not, the lines starting with < and * show where it stopped; find that message below.

Your computer could not reach the proxy at all.

• Check the address and port against your dashboard. The HTTP and SOCKS5 ports are different numbers.
• Check the proxy service is active in your dashboard, not expired or unpaid.
• Some office, school and public networks block outgoing connections to unusual ports. Try another network.

nc -vz 198.51.100.42 PORT      # "succeeded" means the port is reachable

The proxy was reached, but it did not accept a username and password.

• Copy the credentials again: a trailing space is the most common culprit.
• If the password contains @, : or /, percent-encode it in a URL (@ becomes %40).
• Browsers do not read credentials from a proxy URL, and Chrome does not support SOCKS5 with a password at all. Use the HTTP port and the tool's own way of passing credentials; see Using a proxy in Python, Playwright, Puppeteer and Selenium.

For an HTTPS site, the browser asks the proxy to open a tunnel (a CONNECT request), and the proxy said no. In curl -v it shows as CONNECT tunnel failed, response followed by a code:

• 407: credentials missing or wrong, as above. Chrome often reports it this way.
• 403: the proxy will not connect to that destination or port. Many proxies only allow ports 80 and 443.
• 502 or 503: the proxy could not reach the site: it is down, the name does not resolve, or it refused the proxy's connection.

The proxy is working: the request reached the site, and the site decided to refuse it. Requests that come too fast, all at once, or from an address the site has seen misbehave are what triggers it. Slow down, keep one address per session rather than switching mid-session, and respect the site's terms. Whatever address a request comes from, it is still covered by the site's rules and ours.

Time each stage to see where the delay is:

curl -o /dev/null -s -x http://USER:[email protected]:PORT https://example.com \
  -w "proxy %{time_connect}s  tls %{time_appconnect}s  first byte %{time_starttransfer}s  total %{time_total}s\n"

• A slow proxy time is the network between you and the proxy.
• A slow tls or first byte time is usually the site itself.
• If it only happens under load, you may be opening too many connections at once. Reuse connections (a session object in your code) and limit concurrency.

How to test a proxy covers speed and location checks in more detail.