How to fix proxy errors 407, 502, 504 and ERR_TUNNEL_CONNECTION_FAILED

It's very frequent that your scraper suddenly breaks, and the error codes point to a proxy related error.

That status number tells you more than it seems. Proxy error codes point to an issue, usually caused by something else, but each one points to a specific part of the connection: your credentials, the proxy server or the website behind it. Find the broken part, and the fix is usually quick.

A proxied request has three parties: your client (a browser, script or scraping tool), the proxy and the target website. HTTPS sites, which is almost all of them today, add one step. Your client first sends the proxy a CONNECT request asking it to open a tunnel. If the proxy replies "200 Connection established", your encrypted traffic flows through. If it refuses, the request dies before it ever reaches the site.

Here's a breakdown of each error:

Want to catch these problems before they hit a live job? See our guide on how to test proxies before you use them.

407 Proxy Authentication Required

A 407 Proxy Authentication Required error means the proxy turned your request away because it didn't get valid credentials. Your request never left the proxy.

It's easy to mix up with a 401. The difference is who's complaining: a 401 comes from the website, a 407 from the proxy itself. As MDN's reference on the 407 status explains, the proxy sends this response with a Proxy-Authenticate header that tells your client how to authenticate.

Common causes:

• Wrong username or password. Usually a copy-paste slip or an old password.

• Unencoded special characters. An @ or : in your password can confuse your client about where the password ends.

• IP whitelist mismatch. If your plan authenticates by IP, a new server, VPN or router restart can change your public IP and lock you out.

• An inactive plan. With some providers, an expired plan or used-up traffic also returns a 407.

• Credentials dropped on HTTPS. Some tools send credentials with plain HTTP requests but not with the CONNECT request that opens an HTTPS tunnel.

How to fix it:

1. Copy your credentials fresh from your provider's dashboard.

2. URL-encode special characters in the password (@ becomes %40, : becomes %3A).

3. Check your current public IP against your whitelist.

4. Confirm that your plan is active and has balance left.

5. If only HTTPS sites fail, make sure your tool sends credentials with the CONNECT request. Putting them in the proxy URL usually does the trick.

CoreProxy gives you a single proxy string that drops straight into Scrapy, Playwright, Puppeteer, Selenium or any major HTTP client, which cuts out most formatting mistakes. To check a whole list of credentials at once, run them through our free Proxy Checker.

Proxy 502 Bad Gateway

A proxy 502 Bad Gateway error means your credentials worked. The trouble is further down the line: the proxy got an invalid response from the next server upstream.

Common causes:

• The exit node dropped out. Residential and mobile proxies route traffic through real home and mobile connections, and those can go offline mid-request.

• The proxy is overloaded. Too much traffic on one gateway or node can produce broken responses.

• The target closed the connection. Some websites reset connections from IPs they've flagged, and the proxy reports that as a 502.

• Too many requests at once. High concurrency can overwhelm both the proxy and the target.

How to fix it:

1. Retry with a new IP. Most 502s are temporary.

2. Load the target without the proxy, or through a different IP. If it fails everywhere, the website is the problem.

3. Lower your concurrency and add backoff between retries.

4. If one location keeps returning 502s, switch regions and tell your provider.

Rotation is your best defense. With CoreProxy Rotating Residential, you can rotate on every request, so a failed node gets swapped out on the next retry.

Do 502s only show up on one website? Then the IP itself may be flagged. Our guide on checking proxy IP reputation shows you how to confirm it.

504 Gateway Timeout

A 504 Gateway Timeout is the 502's close cousin. With a 502, the proxy got a bad response. With a 504, it got no response in time.

Both codes come from the HTTP standard, RFC 9110, which describes a 504 as a gateway or proxy that didn't hear back in time from the server it needed. One catch: if your client's own timeout is shorter than the proxy's, you'll see a client timeout error instead. The causes and fixes are the same.

Common causes:

• A slow target. Heavy pages, overloaded servers or sites that deliberately slow down suspicious traffic.

• Long distance. A proxy in Asia reaching a server in Europe adds latency to every round trip.

• A slow node in a sticky session. If your session is pinned to a congested IP, every request inherits its delay.

How to fix it:

1. Pick a proxy location close to the target's servers.

2. On a sticky session, start a new one to get a fresh IP.

3. Raise your client timeout for heavy pages, but cap your retries.

4. For speed-sensitive jobs on sites that don't block datacenter IPs, switch to datacenter proxies. They're usually faster than residential ones.

CoreProxy covers 195+ countries, so you can route through a location near your target. For speed-critical work, our Static Datacenter proxies are a strong fit. To dig deeper into latency, read why your proxy is slow and how to fix it.

ERR_TUNNEL_CONNECTION_FAILED

ERR_TUNNEL_CONNECTION_FAILED is a browser error from Chrome and other Chromium-based browsers like Edge, Brave and Opera. An err_tunnel_connection_failed proxy error means your browser reached the proxy and asked it to open an HTTPS tunnel, but the proxy didn't open one.

Here's the tricky part: the browser hides the reason. The proxy might have answered with a 407, a 403 or a 502, yet you see the same generic message every time. Treat it as a wrapper around another error.

Common causes:

• Missing or wrong credentials (a 407 underneath).

• Protocol or port mismatch. For example, a SOCKS5 proxy entered in a field that expects an HTTP proxy.

• Blocked ports or sites. Many proxies, including default Squid setups, only allow tunnels to port 443. Company proxies may also block certain websites on purpose.

• Leftover system settings. An uninstalled VPN or security app can leave old proxy settings behind.

How to fix it:

1. Check your system proxy settings (on Windows: Settings → Network & Internet → Proxy) and remove anything you don't recognize.

2. Confirm the protocol, host and port match what your provider gave you.

3. Re-enter your credentials.

4. Try a different website. If only some sites fail, the proxy is likely blocking them.

For advanced users: reproduce the request with curl to see the real response code the browser is hiding.

curl -v -x http://USER:PASS@HOST:PORT https://example.com

A failure looks like CONNECT tunnel failed, response 407. Older curl versions print Received HTTP code 407 from proxy after CONNECT instead. Either way, the number tells you which section of this guide applies, and the curl documentation covers every proxy option in detail.

A quick troubleshooting workflow

When a proxy error appears and you're not sure where to start, work through these questions in order. Each one rules out a layer of the connection.

1. Can you reach the proxy at all? If not, check the host, port and your local firewall or VPN.

2. Do your credentials work? Send one request to an IP echo service like api.ipify.org. A 407 means you fix authentication first.

3. Does the target load without the proxy? If not, the website is the problem.

4. Does a different IP or location fix it? If yes, you had a bad node or a flagged IP.

5. Does it only fail at scale? Then look at concurrency, rate limits and retries.

Run step 2 on every new proxy before you point a real job at it. It takes seconds and catches most 407s before they cost you a run. Our proxy testing guide turns all five checks into a repeatable routine, with a reference table for codes like 403, 429 and 503.

Your provider matters too, since many 502s and 504s trace back to unstable nodes. CoreProxy offers residential, static residential, datacenter and mobile proxies across 195+ countries, with sticky sessions of up to 7 days or rotation on every request, plus 24/7 support if you get stuck. Get started with CoreProxy and run your first check today.