ERR_TUNNEL_CONNECTION_FAILED: why the proxy would not open a tunnel

Most likely first.

1. Missing or wrong proxy credentials. The most common cause in Puppeteer, Playwright and Selenium. Credentials written into --proxy-server are ignored, so Chromium sends none and the proxy answers 407.
2. The proxy could not reach the site. The site refused or did not answer the exit, the name did not resolve at the proxy, or the exit's IP version does not match the site's. The proxy answers 502, 503 or 504.
3. The proxy refused the destination or the port. Private addresses, blocked sites and closed ports are refused, usually with 403 or 503. Many proxies allow CONNECT only to port 443 and a few others.
4. The account cannot carry traffic. An expired plan or used-up traffic, which providers report as 407 or another error to CONNECT.
5. The wrong proxy type for the port. An HTTP proxy setting pointed at a SOCKS5 port, or at a port that expects TLS, gets no valid answer to CONNECT.
6. Another proxy in between. A company proxy or security tool that inspects TLS can refuse tunnels to some sites or categories.

1. 1Repeat the CONNECT with curl

   The < HTTP line right after > CONNECT is the answer Chrome did not show you.

   The proxy's answer to CONNECTCopy

   curl -v -x http://HOST:PORT -U "USER:PASS" https://TARGET/ -o /dev/null 2>&1 \
     | grep -iE "^(> CONNECT|< HTTP|< x-proxy-reason|\* CONNECT)"

2. 2Print the CONNECT status in scripts

   CONNECT 200 with a site status means the tunnel works and you are looking at a different error. CONNECT 000 means the proxy closed the connection without answering.

   CONNECT status and site statusCopy

   curl -s -o /dev/null -w "CONNECT %{http_connect}, site %{http_code}\n" \
     -x http://HOST:PORT -U "USER:PASS" https://TARGET/

3. 3Capture Chrome's own log

   Open chrome://net-export, start logging, reload the page, then stop. Open the file in the NetLog viewer and search the events for the URL and for TUNNEL: the proxy's status line is there.

4. 4Test a plain http:// site and the target

   If http://example.com/ loads through the proxy and every https:// site fails, the proxy refuses CONNECT. If only one site fails, check its A and AAAA records and read the target reachability guide.

• 407: give the browser its credentials

  Use the proxy login option of your tool, or IP whitelist authentication for Selenium. Percent-encode special characters only where the credentials go inside a URL.

  Playwright and PuppeteerCopy

  // Playwright
  const browser = await chromium.launch({
    proxy: { server: "http://HOST:PORT", username: "USER", password: "PASS" },
  });
  
  // Puppeteer
  const browser = await puppeteer.launch({ args: ["--proxy-server=http://HOST:PORT"] });
  const page = await browser.newPage();
  await page.authenticate({ username: "USER", password: "PASS" });

• 403: check the destination

  Use the site's public hostname, not an internal address, and confirm the port.

• 502, 503 or 504: retry, then widen

  Retry on a new session, then try a wider location such as a country instead of a city. Match the proxy's IP version to the site's addresses.

• No answer at all: match the type to the port

  Use an HTTP proxy setting with the HTTP port and SOCKS5 with the SOCKS5 port.

• net_error_list.h (Chromium network error codes) — The Chromium Projects
• CONNECT (RFC 9110, section 9.3.6) — IETF / RFC Editor
• How to capture a NetLog dump — The Chromium Projects