Proxy Error Codes: What They Mean, What Causes Them and How to Fix Them

Troubleshooting guide · Last reviewed 28 September 2026 · 13 min read

A proxy error is any failure that happens when a request travels through a proxy server: the client cannot reach the proxy, the proxy rejects your credentials, the proxy cannot reach the website, or the website refuses the request it receives. This guide explains every common proxy error code, from HTTP 407 and 502 to ERR_TUNNEL_CONNECTION_FAILED and SOCKS5 reply codes, what causes each one and how to fix it. Use the free proxy checker to test a proxy while you work through it.

What Is a Proxy Error?

A request through a proxy makes two trips instead of one. Your browser, script or tool first connects to the proxy server and, on most paid proxies, proves who you are with a username and password. The proxy then connects to the website on your behalf, sends the request, and passes the website’s answer back to you.

That gives three places where something can go wrong, and each produces a different kind of error:

• Client to proxy. Wrong host or port, the proxy is unreachable, or the credentials are wrong. Typical errors: ERR_PROXY_CONNECTION_FAILED, “The proxy server is refusing connections”, HTTP 407.
• Proxy to website. The proxy cannot resolve, reach or get a valid answer from the site. Typical errors: HTTP 502 and 504, ERR_TUNNEL_CONNECTION_FAILED, SOCKS5 “host unreachable”.
• The website’s answer. The site received your request and refused it or failed. Typical errors: HTTP 403, 429, 500 and 503, passed back through the proxy unchanged.

Status codes in the 2xx and 3xx ranges are not errors. A 204 No Content or 206 Partial Content is a successful response, and 301 or 302 redirects only tell the client to follow a new location. If a redirect loops, check the client’s redirect settings and cookies rather than the proxy.

Quick Proxy Troubleshooting Checklist

1. Check the host and port. Copy them again from your provider’s dashboard. A single wrong digit in the port gives a connection error, not a helpful message.
2. Check the credentials and their format. Most tools expect http://USERNAME:PASSWORD@host:port. Special characters in the password must be URL-encoded in that format.
3. Match the protocol. An HTTP client pointed at a SOCKS5 endpoint, or the reverse, fails at the first byte. Use the scheme your provider gives for that port.
4. Test from the command line. Run the request with curl in verbose mode. It shows whether the failure is the connection, the CONNECT tunnel or the site’s response.
5. Compare with no proxy. If the site also fails without the proxy, the problem is the site or your network, not the proxy.
6. Try another target. If one site fails and others work through the same proxy, the site is blocking or failing, not the proxy.
7. Get a fresh IP. Rotate the session or start a new one. If the error disappears, the previous IP was blocked or went offline.
8. Check your account. Remaining bandwidth, the product you are using and any location targeting you set.

curl -v -x http://USERNAME:PASSWORD@v2.proxyempire.io:5000 https://example.com -o /dev/null

# Look for these lines in the output:
#   "Connected to v2.proxyempire.io"    -> client reached the proxy
#   "CONNECT tunnel failed, response 407" -> credentials rejected
#   "HTTP/1.1 200 Connection established" -> tunnel is open
#   "HTTP/2 403" or "HTTP/2 429"         -> the website's answer

More curl options are in our guide to using curl with a proxy.

HTTP Proxy Error Codes and How to Fix Them

HTTP status codes are defined in RFC 9110, with 429 in RFC 6585. The same code can come from the proxy or from the website, so the “usually caused by” column matters as much as the definition.

407 Proxy Authentication Required

The proxy is reachable but has not accepted who you are. On a username-and-password proxy, it almost always means the credentials are missing, mistyped or in the wrong format for your tool. Copy them again, check that special characters are URL-encoded, and make sure the tool actually sends proxy authentication. Some tools only send it after a first 407 challenge, and some need it set separately for HTTP and HTTPS. We cover .NET and C# in detail in our guide to fixing HTTP 407 errors. If your proxies are from ProxyEmpire and you work in Claude, ChatGPT or Cursor, the ProxyEmpire MCP server can check a 407 for you: it looks at your package, credentials, remaining bandwidth and the pool, and tells you which one to fix.

502 Bad Gateway and 504 Gateway Timeout

Both mean the proxy reached out and did not get a usable answer. A 502 is an invalid response, a 504 is no response in time. Check whether the site loads without the proxy first. If it does, rotate to a new IP, since a single exit can be slow or unable to reach a particular site, and give slow pages a longer timeout.

403 Forbidden and 429 Too Many Requests

These usually come from the website, not the proxy. A 403 through a proxy often means the site blocks that IP range, that country, or requests that do not look like a normal browser. A 429 is a rate limit: slow down, read the Retry-After header if the site sends one, and spread requests across more IPs with rotating residential proxies.

Browser Proxy Errors

Browsers show their own error names instead of HTTP codes when the failure happens before a normal response. Chrome and Edge use Chromium’s network error list; the descriptions below are Chromium’s own.

How to fix ERR_TUNNEL_CONNECTION_FAILED

For HTTPS sites, the browser asks the proxy to open a tunnel with a CONNECT request. ERR_TUNNEL_CONNECTION_FAILED means that tunnel was never opened. In order of likelihood: the proxy rejected your credentials, the proxy does not allow connections to that destination or port, or the exit could not reach the site. Test the same proxy with curl in verbose mode: a “CONNECT tunnel failed, response 407” line points to credentials, any other response code to the destination. If you set a proxy by mistake, turn it off in the browser or system proxy settings; our guide to Chrome proxy settings shows where.

SOCKS5 Proxy Errors

SOCKS5 does not use HTTP status codes. After a connection request, the server answers with a one-byte reply code defined in RFC 1928. Tools print it in different ways, but the meaning is the same.

Authentication problems show up earlier. If the server answers the method negotiation with 0xFF, “no acceptable methods”, the client did not offer a method the server accepts. On a username-and-password proxy, that usually means the client is not sending credentials at all.

SSL, TLS and Certificate Errors Through a Proxy

“SSL handshake failed” and similar errors mean the encrypted connection could not be set up. Through a proxy, the most common causes are:

• The wrong proxy scheme. Most proxies are addressed with http:// even for HTTPS websites; the HTTPS connection to the site runs inside the CONNECT tunnel. Setting the proxy itself as https:// when it expects plain HTTP breaks the handshake.
• Traffic inspection. Corporate firewalls and some security software intercept HTTPS and present their own certificates, which a script will reject.
• An old client. Outdated TLS libraries cannot negotiate with modern sites. Update the client or runtime.
• A wrong system clock. Certificates are time-bound, so a clock that is far off makes valid certificates look invalid.

Avoid turning off certificate verification to make the error go away. It hides the problem and exposes your traffic.

Proxy Errors in Code: curl, Python and Headless Browsers

curl reports a numeric exit code plus a message. Exit code 7 means it could not connect to the host or proxy. Exit code 56 is a failure receiving network data, which through a proxy often appears as “CONNECT tunnel failed, response 407” or with another status code.

Python requests raises ProxyError when it cannot connect to the proxy or the proxy refuses the tunnel, SSLError for handshake problems, and ConnectTimeout or ReadTimeout for slow hops. Responses such as 403 and 429 are not exceptions: check response.status_code. Our Python requests proxy guide covers setup.

Puppeteer and Playwright surface Chromium’s errors with a net:: prefix, such as net::ERR_TUNNEL_CONNECTION_FAILED. Chromium does not accept credentials in the proxy URL, so pass the username and password through the library’s own authentication option.

import random, time
import requests

PROXY = "http://USERNAME:PASSWORD@v2.proxyempire.io:5000"
RETRY_STATUS = {429, 500, 502, 503, 504}

def fetch(url, attempts=4):
    for attempt in range(attempts):
        try:
            r = requests.get(url, proxies={"http": PROXY, "https": PROXY}, timeout=30)
        except (requests.exceptions.ProxyError,
                requests.exceptions.ConnectTimeout,
                requests.exceptions.ReadTimeout):
            r = None                      # connection-level failure: retry
        if r is not None and r.status_code not in RETRY_STATUS:
            return r                      # success, or an error retrying won't fix
        wait = 2 ** attempt + random.random()
        if r is not None and r.headers.get("Retry-After", "").isdigit():
            wait = int(r.headers["Retry-After"])
        time.sleep(wait)                  # each new request can leave from a new IP
    raise RuntimeError(f"gave up on {url}")

With a rotating proxy set to a new IP per request, each retry above automatically leaves from a different address. A 407 is deliberately not retried: wrong credentials will not fix themselves.

Causes Specific to Your Proxy Provider

Some failures come from how a proxy service is set up rather than from the network. Using ProxyEmpire as the example:

• Authentication is username and password only. There is no IP whitelisting, so a 407 always points to credentials or how your tool sends them.
• Destination ports 80 and 443 are open by default. Other ports can be opened on request after a verification (KYC) and use-case review. Mail ports are never opened: port 25 and the other email ports stay blocked on every product, so the proxies can’t send email (see Port 25 usage). A tunnel failure to an unusual port is expected, not a fault.
• Some site categories are blocked on every product. Financial, government and other high-risk sites, such as banks, payment processors and crypto exchanges, are refused by default and can only be enabled after KYC and a use-case review.
• Sticky sessions follow a real device. A sticky IP stays until you rotate it or the device behind it goes offline. When it goes offline, requests on that session fail; start a new session to continue. Our guide to sticky and rotating proxies explains the trade-off.
• Bandwidth and targeting. Check your remaining bandwidth in the dashboard, and remember that very narrow targeting, such as a small city on one ISP, has fewer IPs to rotate through.

Still stuck? ProxyEmpire’s support team is available 24/7 and is made up of real people. Include the full error message, the time, and the proxy settings you used, without your password.

How to Prevent Proxy Errors at Scale

Error rates are also your earliest warning. A jump in 403s on one site means it changed its defences; a jump in timeouts across every site points to your own network or the proxy route. Tracking both separately saves hours of guessing.

Proxy Error FAQ

References

1. RFC 9110: HTTP SemanticsStatus codes 400 to 504, including 407 Proxy Authentication Required (section 15.5.8)
2. RFC 6585: Additional HTTP Status Codes429 Too Many Requests and Retry-After
3. RFC 1928: SOCKS Protocol Version 5Authentication methods and reply codes
4. net_error_list.hChromium network error definitions (ERR_ codes)
5. libcurl error codescurl exit codes such as 7 and 56