Skip to content
Language: EN
EnglishالعربيةРусский中文Tiếng Việt
Start trialDashboard
Start trial

502 Bad Gateway from a proxy: what failed behind it

A 502 means a gateway got no usable answer from the server behind it. If the proxy sends it in reply to CONNECT, the proxy could not reach the site: the name did not resolve, the IP version did not match, or the site did not answer through that exit. If it arrives after 200 Connection established, the site's own gateway or CDN sent it, and the proxy did its job.

Reviewed by John Hale. Last updated .

Run the free proxy checker All proxy checker error codes

What it looks like

From the proxy
> CONNECT example.com:443 HTTP/1.1
< HTTP/1.1 502 Bad Gateway
* CONNECT tunnel failed, response 502
curl: (56) CONNECT tunnel failed, response 502

From the site's own gateway
< HTTP/1.1 200 Connection established
...
> GET / HTTP/2
< HTTP/2 502
< server: nginx

What does 502 Bad Gateway mean through a proxy?

RFC 9110 defines 502 as a gateway or proxy that received an invalid response from the server it contacted to fulfil the request (section 15.6.3). In practice proxies also send it when they cannot reach the destination at all.

There can be several gateways in a row: your proxy, the exit behind it, the site's CDN and the site's load balancer. Each can produce a 502, so the first question is which one sent it.

502 sits next to 503 and 504. A 503 says a service is unavailable right now, often a capacity or port refusal; a 504 says a gateway waited too long for an answer.

What causes a 502 from a proxy?

Most likely first.

  1. The site's origin is down behind its CDN. The CDN answers for the site and gets nothing usable from the origin. This 502 arrives inside the tunnel, and visitors without a proxy see it too.
  2. The name does not resolve at the proxy. A typo, an internal hostname, or a name that exists only on your local network. With any HTTP proxy, and with SOCKS5 through socks5h://, the proxy resolves the name, not your computer.
  3. IPv4 and IPv6 do not match. An IPv6 proxy cannot reach a site that has no IPv6 address, and an IPv4 exit cannot reach a site that has only IPv6. Proxies that check this answer 502.
  4. The exit could not reach the site. The site may refuse the exit's network, or the exit may have dropped while the connection was being set up. A sticky session keeps returning to the same exit.
  5. The wrong port. Connecting to a port the site does not serve, such as 8443 on a site that only answers on 443.

How do you find what failed?

  1. Find which gateway sent it

    A 502 right after > CONNECT is the proxy's. A 502 after 200 Connection established is the site's.

    Proxy's answer, then the site's
    curl -v -x http://HOST:PORT -U "USER:PASS" https://TARGET/ -o /dev/null 2>&1 \
  | grep -iE "^(> CONNECT|< HTTP|< x-proxy-reason|\* CONNECT)"

  2. Check the name and its addresses

    An empty A answer means an IPv4 proxy cannot reach the site; an empty AAAA answer means an IPv6 proxy cannot. On Windows, use nslookup -type=AAAA TARGET. The IPv6 readiness test checks a site in the browser.

    IPv4 and IPv6 records
    dig +short A TARGET
dig +short AAAA TARGET

  3. Test a neutral site through the same proxy

    %{http_connect} is the proxy's answer to CONNECT and %{http_code} the site's. If the neutral site works while the target gets 502 on CONNECT, the target or the route to it failed.

    Neutral site, then the target
    curl -s -o /dev/null -w "neutral: %{http_connect} %{http_code}\n" -x http://HOST:PORT -U "USER:PASS" https://api.ipify.org
curl -s -o /dev/null -w "target: %{http_connect} %{http_code}\n" -x http://HOST:PORT -U "USER:PASS" https://TARGET/

  4. Retry on a new exit

    Change the session ID or let a rotating session pick another exit. A 502 that goes away on a new exit was that exit's route.

How do you fix a 502?

  • A 502 from the site

    Wait and retry with backoff. Nothing on the proxy side needs changing, and the site's status page often says more.

  • A name or address problem

    Use the public hostname and check its spelling. Use an IPv4 proxy for sites with only an A record, and an IPv6 proxy only for sites with an AAAA record.

  • A route problem

    Retry idempotent requests a few times on a new session, or target another city or country. If every exit fails for one site and works for others, the site is refusing that network.

If you use TrueProxies

When the gateway knows why a destination cannot be reached, it answers CONNECT with 502 and a reason in X-Proxy-Reason and the body. A refused name is learned after one attempt and refused at once from then on.

TrueProxies 502 reasons
X-Proxy-ReasonWhat it meansWhat to do
IPv4 proxies reach IPv4 destinations only. This destination has no IPv4 address.A Residential IPv4 service asked for a name with no IPv4 address.Use Residential IPv6 or Datacenter IPv6 for that site.
Datacenter IPv6 proxies reach IPv6 destinations only. This destination has no IPv6 address.The site has no IPv6 address.Use Residential IPv4 for that site.
Residential IPv6 proxies reach IPv6 destinations only. This destination has no IPv6 address.The site has no IPv6 address, and the IPv4 fallback's fair-use limits were reached.Use Unlimited Bandwidth for steady IPv4 work.
Destination not found. This name does not exist.The DNS answer for the name is NXDOMAIN.Check the hostname.
No response. The destination did not answer through this IP. Your sticky session keeps its IP; retry the request.The sticky IP works for other sites, but this site did not answer through it.Retry, or use a new session ID for a new IP.

A 503 with no reason means no exit was free for the targeting you asked for, the site refused, reset or did not answer the connection, or the port is closed: mail ports 25, 465, 587 and 2525 are closed on every service. On SOCKS5 all of these are reply 0x03, network unreachable.

Usage history lists Destination has no IPv4 address, Destination has no IPv6 address and Destination not found under Not counted against success: no proxy can reach those destinations, so they do not lower your connection success.

Test the proxy from outside your network

The free proxy checker connects from our servers and reports the failed stage as a code, so you can tell a proxy problem from one on your computer or network.

Run the proxy checker

Questions about 502 Bad Gateway from a proxy

Is a 502 my fault or the proxy's?

Usually neither. It means the route to the destination failed. Find which gateway sent it with curl -v before changing anything.

Why do I get a 502 only through the proxy?

The proxy reaches the site from a different network, resolves its name with a different resolver, and may use a different IP version. Compare the site's A and AAAA records with the proxy's IP version.

Should I retry a 502?

Yes, a few times with backoff, for requests that are safe to repeat such as GET. If the same exit keeps returning 502, move to a new session.

What is the difference between 502 and 504 through a proxy?

A 502 means the gateway got a bad answer or none it could use; a 504 means it waited and gave up. Either can come from the proxy or from the site's own gateway.

Sources

Related errors

ERR_TUNNEL_CONNECTION_FAILED

The proxy answered the browser's CONNECT with an error. The status it sent is the real cause.

403 Forbidden through a proxy

Usually the website's refusal after the tunnel opened; sometimes the proxy refusing the destination.

curl error 56

Recv failure, Proxy CONNECT aborted or CONNECT tunnel failed: what each curl (56) message means.

The proxy checker error codes page maps each checker code to the stage that failed, and proxy errors explained covers timeouts and slow connections.