New Residential Premium, our top-tier pool for the toughest sites

Troubleshooting

Proxy errors and how to fix them

What 407, ERR_TUNNEL_CONNECTION_FAILED, 502 and 503, timeouts, refused connections, SSL errors and wrong-country results mean, why they happen, and what to do about each. It applies to any proxy; the fixes mention ZenProxy where it helps.

First step for any error: test the line on its own

Browsers and libraries often hide the proxy’s real answer behind a generic message. Run the same line through cURL with -v. For an HTTPS site you’ll see a CONNECT request and the proxy’s reply: 200 means the tunnel is open; any other code is the reason it isn’t.

Terminal 
curl -v -x "http://USERNAME:PASSWORD@HOST:PORT" https://ipinfo.io/json

If cURL works and your tool doesn’t, the problem is in how the tool sends the proxy settings. The setup guides cover each tool. You can also check an HTTP line with the free proxy checker.

At a glance

ErrorWhat it means
407 Proxy Authentication RequiredThe proxy was reached, but it didn’t accept the username and password it received, or it received none at all.
ERR_TUNNEL_CONNECTION_FAILED and “CONNECT tunnel failed”For an HTTPS site, your client first asks the proxy to open a tunnel with a CONNECT request. This error means the proxy answered that request with something other than “200, tunnel open”. Browsers hide the real reason behind this one generic error.
502 Bad Gateway and 503 Service Unavailable from the proxyThe proxy accepted your login but couldn’t get a working connection to the site through the exit IP.
TimeoutsYour client gave up waiting, either for the connection to the proxy or for the site’s answer through it.
Connection refused and ERR_PROXY_CONNECTION_FAILEDYour machine couldn’t open a connection to the proxy at all. Nothing reached the exit IP yet.
SSL and certificate errorsSomething went wrong with TLS, either between your client and the proxy or between your client and the site.
Wrong country or locationEither the exit IP isn’t where you asked for, or the site decides your location from something other than the IP.
The IP doesn’t changeRotation happens when your client opens a new connection. HTTPS requests travel through a tunnel, and every request sent through the same open tunnel leaves from the same IP.
403, 429 and CAPTCHAs from the siteThese come from the website, not from the proxy. The tunnel worked; the site decided not to serve you.

407 Proxy Authentication Required

The proxy was reached, but it didn’t accept the username and password it received, or it received none at all.

How it shows up

  • curl: (56) CONNECT tunnel failed, response 407
  • ProxyError('Unable to connect to proxy', OSError('Tunnel connection failed: 407 Proxy Authentication Required')) in Python requests
  • Proxy response (407) !== 200 when HTTP Tunneling in Node.js (undici)
  • A browser that keeps showing a proxy sign-in dialog

Common causes

  • A typo, a missing character or a trailing space or line break copied with the line.
  • The tool dropped the credentials. Chrome’s --proxy-server flag, for example, ignores a username and password written into it.
  • A password with characters such as @, :, / or # inside a URL, where they need to be URL-encoded.
  • A username you edited by hand. A wrong targeting tag makes the username one the proxy doesn’t know.
  • The plan has expired or has no data left.

How to fix it

  • Copy a fresh line from the generator and paste it unchanged.
  • Test the line on its own with the curl -v command below. If cURL works, the problem is in how your tool sends the credentials.
  • In URL formats, URL-encode special characters in the username and password (@ becomes %40).
  • For tools that can’t send a password (system proxy settings, some apps), add your IP on the Access & API page if your plan supports login by IP.
  • Check data left and time left for the plan on the My proxies page.
Test a line from the terminal 
curl -v -x "http://USERNAME:PASSWORD@HOST:PORT" https://ipinfo.io/json

ERR_TUNNEL_CONNECTION_FAILED and “CONNECT tunnel failed”

For an HTTPS site, your client first asks the proxy to open a tunnel with a CONNECT request. This error means the proxy answered that request with something other than “200, tunnel open”. Browsers hide the real reason behind this one generic error.

How it shows up

  • net::ERR_TUNNEL_CONNECTION_FAILED in Chrome, Puppeteer, Playwright and Selenium
  • curl: (56) CONNECT tunnel failed, response 502
  • TunnelError: Could not open CONNECT tunnel with proxy … in Scrapy
  • Tunnel connection failed: 503 Service Unavailable in Python requests

Common causes

  • Authentication failed (the hidden status is 407).
  • The proxy couldn’t reach the site through the exit IP (the hidden status is 502 or 503).
  • The targeting asks for a location the plan can’t serve.
  • The destination isn’t allowed under our Acceptable Use Policy.

How to fix it

502 Bad Gateway and 503 Service Unavailable from the proxy

The proxy accepted your login but couldn’t get a working connection to the site through the exit IP.

How it shows up

  • curl: (56) CONNECT tunnel failed, response 502
  • HTTP/1.1 503 Service Unavailable on a plain http:// request
  • Tunnel connection failed: 502 Bad Gateway in Python requests

Common causes

  • The site is down, slow, or refused the connection from that IP.
  • The exit IP dropped. Residential IPs are real home devices and can go offline.
  • Targeting the proxy can’t match. For example, on Residential Lite you can choose states only in the United States and Canada, and cities only in the United States (together with the state). Other combinations are refused straight away.
  • A typo in the target hostname or port.

How to fix it

  • Retry on a new connection. On a rotating line, that gives you a new IP.
  • Widen the targeting: try country only, then add the state or city back. The generator only offers the location options your plan supports.
  • Open the site without the proxy to rule out an outage.
  • If it happens on every request and every site, contact support with the time and the line you used (without the password).

Timeouts

Your client gave up waiting, either for the connection to the proxy or for the site’s answer through it.

How it shows up

  • curl: (28) Operation timed out
  • requests.exceptions.ReadTimeout or ConnectTimeout in Python
  • TimeoutError: Navigation timeout of 30000 ms exceeded in Puppeteer
  • context deadline exceeded (Client.Timeout exceeded while awaiting headers) in Go

Common causes

  • The timeout is too short for a page loaded through a home connection on the other side of the world.
  • The site is slow or is deliberately slowing you down.
  • Too many requests at once from your machine, which saturates your own connection or file limits.
  • A connect timeout to the proxy itself, which points at a network or firewall problem on your side (see Connection refused below).

How to fix it

  • Set explicit timeouts. 30 to 60 seconds is a sensible start for residential traffic.
  • Retry timed-out requests on a new connection, which gives a rotating line a new IP.
  • Lower concurrency and see if the timeouts stop.
  • Choose an exit country close to the site’s servers.
  • For speed-sensitive jobs on sites that allow them, use datacenter or ISP IPs, which run on server connections.

Connection refused and ERR_PROXY_CONNECTION_FAILED

Your machine couldn’t open a connection to the proxy at all. Nothing reached the exit IP yet.

How it shows up

  • curl: (7) Failed to connect to HOST port PORT
  • ECONNREFUSED or ETIMEDOUT in Node.js
  • net::ERR_PROXY_CONNECTION_FAILED in Chrome
  • proxyconnect tcp: dial tcp HOST:PORT: connect: connection refused in Go
  • “The proxy server is refusing connections” in Firefox

Common causes

  • The wrong host or port. SOCKS5 has its own port, so an HTTP client pointed at the SOCKS5 port (or the other way round) fails.
  • A firewall, antivirus or office network that blocks outgoing connections on the proxy port.
  • A VPN or another proxy tool on your machine that intercepts the connection.

How to fix it

  • Copy the host and port again from the generator, and pick the protocol (HTTP or SOCKS5) that your tool uses.
  • Try curl -v from the same machine. If it fails there too, try another network, such as a phone hotspot, to rule out a firewall.
  • Turn off other VPN or proxy apps while you test.

SSL and certificate errors

Something went wrong with TLS, either between your client and the proxy or between your client and the site.

How it shows up

  • SSL: WRONG_VERSION_NUMBER in Python
  • EPROTO … wrong version number in Node.js
  • curl: (35) … wrong version number
  • CERTIFICATE_VERIFY_FAILED or unable to get local issuer certificate
  • NET::ERR_CERT_AUTHORITY_INVALID in Chrome

Common causes

  • A proxy URL that starts with https://. That tells many clients to speak TLS to the proxy itself. ZenProxy lines start with http://, and your HTTPS traffic is still encrypted end to end inside the tunnel.
  • Something on your machine that inspects HTTPS traffic: antivirus “web shield” features, office firewalls, debugging proxies, or tools such as selenium-wire.
  • An outdated CA bundle or system clock.

How to fix it

  • Write the proxy as http://USERNAME:PASSWORD@HOST:PORT, also for HTTPS sites.
  • Turn off HTTPS scanning in your antivirus while you test, or test from another machine.
  • Update your OS certificates and check the system clock.
  • Don’t switch off certificate checks (verify=False, -k) to make the error go away. It hides the problem and exposes your traffic.

Wrong country or location

Either the exit IP isn’t where you asked for, or the site decides your location from something other than the IP.

How it shows up

  • The site shows prices or language for another country
  • ipinfo.io/json shows a different country than you chose
  • Search results are for your home city

Common causes

  • No country set. Without targeting, a residential line can exit anywhere.
  • A sticky line generated before you changed the country. It keeps its original IP until it expires.
  • IP location databases disagree. A site can place an IP in a neighboring region.
  • Your browser gives you away: timezone, language, cookies, a signed-in account, or GPS on phones.
  • DNS resolved on your machine (socks5:// instead of socks5h://), so the site serves you a server near you.
  • Datacenter and ISP IPs have a fixed location, chosen when you buy them.

How to fix it

  • Set the country in the generator, or on residential plans add -country-xx to the username (for example USERNAME-country-us). Use two-letter ISO codes such as gb for the United Kingdom.
  • Generate new sticky lines after changing the location.
  • Check the exit with https://ipinfo.io/json through the same line.
  • Match browser timezone and language to the proxy country, and use a clean profile without old cookies.
  • With SOCKS5, use socks5h:// so DNS is resolved at the exit.

The IP doesn’t change

Rotation happens when your client opens a new connection. HTTPS requests travel through a tunnel, and every request sent through the same open tunnel leaves from the same IP.

How it shows up

  • A rotating line returns the same IP for several requests
  • Every request in a session comes from one IP

Common causes

  • Your client reuses connections (sessions, keep-alive agents, connection pools). That’s the default in most libraries and browsers.
  • You’re using a sticky line, which is meant to keep its IP.

How to fix it

  • Open a new connection per request when you need a new IP each time: a fresh client per request, keep-alive off, or a connection limit of one request.
  • Or generate many sticky lines (set Sticky Amount in the generator) and pick a different line for each request or task.
  • Keep connection reuse when you don’t need a new IP on every request. It’s faster.

403, 429 and CAPTCHAs from the site

These come from the website, not from the proxy. The tunnel worked; the site decided not to serve you.

How it shows up

  • 403 Forbidden or 429 Too Many Requests
  • A CAPTCHA or “unusual traffic” page

Common causes

  • Too many requests too fast from one IP or one session.
  • An IP type the site distrusts, often datacenter ranges on protected sites.
  • A browser fingerprint or headers that look automated.

How to fix it

  • Slow down and spread requests over more IPs with a rotating line.
  • Use residential IPs for protected sites, and sticky lines when you log in.
  • Send realistic headers, or use a real browser (Playwright, Puppeteer) for sites that check JavaScript.
  • Retry blocked requests on a new connection, not the same IP.

Questions

What does 407 Proxy Authentication Required mean?

The proxy was reached but didn’t accept the username and password, or none were sent. Copy a fresh line from the generator, make sure your tool actually sends the credentials, and URL-encode special characters if you use the URL format.

How do I fix ERR_TUNNEL_CONNECTION_FAILED?

It’s a generic browser error for a failed CONNECT request. Run the same proxy line through curl -v to see the real status code. A 407 means a login problem; a 502 or 503 means the proxy couldn’t reach the site through the exit IP.

Is a 403 or 429 a proxy error?

No. Those come from the website through a working tunnel. Slow down, rotate IPs, or switch to residential or sticky lines depending on the site.

Why does my rotating proxy keep the same IP?

Your client reuses the open connection. Requests sent through one open tunnel share its exit IP. Open a new connection per request, or use a different sticky line per task.

Proxies that come with support

Try 1 GB of Residential Lite for $0.49. Copy your lines from the generator, and if something on our side doesn’t work, we fix it or refund you.

Buy 1 GB for $0.49 Get your lines from the generator

Broken on our side? Fixed in 48h or refunded.

Setup guides

APAdsPowerPYPythonJSNode.jsSCScrapyPPPuppeteerPWPlaywrightSESeleniumCUcURL

All integrations →