Skip to content
Language: EN
EnglishالعربيةРусский中文Tiếng Việt
Start trialDashboard
Start trial

curl error 56 through a proxy: what each message means

curl exits with code 56 (CURLE_RECV_ERROR) when receiving data fails. Through a proxy it usually comes with one of three messages: CONNECT tunnel failed, response N (the proxy answered the tunnel request with status N), Proxy CONNECT aborted (the proxy closed the connection without answering), or Recv failure: Connection reset by peer (the connection was reset). The text after the colon is the diagnosis.

Reviewed by John Hale. Last updated .

Run the free proxy checker All proxy checker error codes

What it looks like

curl 8
curl: (56) CONNECT tunnel failed, response 407
curl: (56) Proxy CONNECT aborted
curl: (56) Recv failure: Connection reset by peer

curl 7 and OpenSSL 3 builds
curl: (56) Received HTTP code 407 from proxy after CONNECT
curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0

What does curl error 56 mean?

libcurl documents CURLE_RECV_ERROR (56) as a failure with receiving network data. It is a family rather than one error, so two runs that both exit 56 can have unrelated causes.

Through an HTTP proxy, curl first sends CONNECT host:443 and reads the proxy's answer, then starts TLS with the site inside the tunnel. A failure while reading the proxy's answer exits 56. A reset during the TLS handshake that follows exits 35 instead, and a failure in the middle of the download exits 56 again.

What causes curl error 56 through a proxy?

Most likely first.

  1. The proxy refused the tunnel: CONNECT tunnel failed, response N. N is the proxy's status. 407 is a login problem, 403 a refused destination, 502 or 503 a destination the proxy could not reach. curl 7 printed the same failure as Received HTTP code N from proxy after CONNECT.
  2. The proxy type does not match the port: Proxy CONNECT aborted. -x http://HOST:PORT against a SOCKS5 port or a TLS-only port gets no HTTP answer, and the proxy closes the connection. A proxy that drops clients it does not accept, or one under heavy load, does the same.
  3. A reset: Recv failure: Connection reset by peer. The proxy, the exit or the site reset the connection while curl was reading. See ECONNRESET through a proxy for the causes.
  4. A transfer cut short: unexpected eof while reading. OpenSSL 3 builds report a TLS connection that ended without a proper close this way. The site or the route stopped mid-transfer.
  5. A proxy you did not mean to use. curl reads http_proxy, HTTPS_PROXY and ALL_PROXY from the environment and proxy from ~/.curlrc, so a forgotten setting can send requests through a proxy that no longer works.

How do you debug curl error 56?

  1. Print the proxy's answer and curl's exit code

    For a refused login this prints CONNECT 407 | site 000 | exit 56. CONNECT 000 means the proxy never answered.

    One line per request
    curl -s -o /dev/null -w "CONNECT %{http_connect} | site %{http_code} | exit %{exitcode}\n" \
  -x http://HOST:PORT -U "USER:PASS" https://TARGET/

  2. Look for a proxy you did not set

    The sed hides passwords in proxy URLs. --noproxy '*' sends one request without any proxy.

    Proxy settings curl may pick up
    env | grep -i _proxy | sed -E 's#(://[^:/@]+:).*@#\1****@#'
grep -i proxy ~/.curlrc
curl -sS --noproxy '*' -o /dev/null -w "direct: %{http_code}\n" https://TARGET/

  3. Try each proxy type on its own port

    Only the pairing your provider documents should work. A type that answers on the wrong port shows up as Proxy CONNECT aborted.

    HTTP, HTTPS and SOCKS5
    curl -v -x http://HOST:HTTP_PORT -U "USER:PASS" https://example.com/ -o /dev/null
curl -v -x https://HOST:HTTPS_PORT -U "USER:PASS" https://example.com/ -o /dev/null
curl -v --socks5-hostname HOST:SOCKS_PORT -U "USER:PASS" https://example.com/ -o /dev/null

  4. Take a full trace

    --trace-ascii trace.txt records every byte curl sent and received. The trace contains your Proxy-Authorization header, which is your credentials in base64: delete it from the file before you share it.

How do you fix curl error 56?

  • Fix what the message names

    For response 407, fix the credentials as in 407 Proxy Authentication Required. For 403, 502 or 503, see the 403 and 502 pages. For Proxy CONNECT aborted, pair the proxy type with its port, and use --socks5-hostname for SOCKS5.

  • Retry resets on safe requests

    Plain --retry retries only errors curl treats as transient, such as timeouts and HTTP 429, 502, 503 and 504; --retry-all-errors adds everything else, including 56.

    Retry every failure three times
    curl --retry 3 --retry-all-errors --retry-delay 2 \
  -x http://HOST:PORT -U "USER:PASS" https://TARGET/

  • Clear stale proxy settings

    Remove the proxy line from ~/.curlrc and unset the variables you did not mean to keep.

    Unset proxy variables
    unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY all_proxy ALL_PROXY

If you use TrueProxies

Use -x http://HOST:8080 for both http:// and https:// sites, -x https://HOST:8443 for TLS to the proxy, and --socks5-hostname HOST:1080 for SOCKS5.

The gateway puts its reason in X-Proxy-Reason on every 407 and on the 502s it can explain. Print it next to curl's error:

The gateway's reason and curl's error
curl -v -x http://HOST:8080 -U "USER:PASS" https://TARGET/ -o /dev/null 2>&1 \
  | grep -iE "x-proxy-reason|^curl: \("

SOCKS5 failures exit with curl's SOCKS codes rather than 56 and carry no reason: a refused SOCKS5 login prints curl: (97) User was rejected by the SOCKS5 server (1 1). Send the same username and proxy password once through port 8080 to read the gateway's sentence.

Test the proxy from outside your network

The free proxy checker connects from our servers and reports the failed stage as a code, so you can tell a proxy problem from one on your computer or network.

Run the proxy checker

Questions about curl error 56

What does curl error 56 mean?

CURLE_RECV_ERROR: curl failed while receiving data. Through a proxy, the message after (56) says whether the proxy refused the tunnel, closed without answering, or the connection was reset.

Is curl error 56 the same as curl error 35?

No. 35 is a TLS handshake failure. A reset during the handshake inside the tunnel shows as (35) Recv failure: Connection reset by peer, while the same reset before the proxy answered shows as (56).

Why do I get Received HTTP code 407 from proxy after CONNECT?

That is how curl 7 reported a 407 to CONNECT; curl 8 prints CONNECT tunnel failed, response 407. Both mean the proxy refused the credentials.

How do I make curl retry on error 56?

Add --retry 3 --retry-all-errors. Plain --retry skips error 56. Use it only for requests that are safe to repeat.

Sources

Related errors

ECONNRESET through a proxy

Connection reset by peer in Node.js or Python: stale keep-alive sockets, the wrong port, or a cut route.

407 Proxy Authentication Required

The proxy wants credentials it did not get or did not accept. The website never saw the request.

ERR_TUNNEL_CONNECTION_FAILED

The proxy answered the browser's CONNECT with an error. The status it sent is the real cause.

The proxy checker error codes page maps each checker code to the stage that failed, and proxy errors explained covers timeouts and slow connections.