Fix proxy errors with and without a VPN

The message “cannot establish proxy connection” does not appear in the error-page string files of Chrome or Firefox, and people who search for it add the word VPN and the name of the VeePN extension. Behind the message the browser shows one of three codes: ERR_PROXY_CONNECTION_FAILED, ERR_TUNNEL_CONNECTION_FAILED or ERR_SOCKS_CONNECTION_FAILED. Each code marks a failure at a different stage of the connection and has its own fix.

Most desktop users see codes of the ERR_… kind. According to StatCounter for September 2026, Chrome holds 65.09% of desktop browsers, Edge 14.64% and Firefox 6.11%. Chrome and Edge are built on Chromium, so this guide follows their codes and gives Firefox wording on separate lines. I reproduced every error on test proxies in Chromium 141 and curl 8.22.0, and I describe what I saw on the screen.

Difficulty, time and requirements

• The difficulty is medium: steps 1–3 and 8 are done in the browser and system interface, steps 4–7 need a terminal.
• One proxy takes 15–20 minutes (my estimate).
• You need the proxy host, port, login and password from your provider.
• For software you need Chrome, Edge or Firefox, plus curl, which ships with Windows 10 and 11 and with macOS.
• At the end you know at which stage the connection breaks, and the page opens through the proxy.

Who this proxy connection guide is for

I wrote this guide for two groups. The first entered a purchased proxy into Chrome, Edge or Firefox by hand and got an error code where the page should be. The second uses a VPN extension or a VPN app and sees a message that the proxy connection could not be established. Both groups need it for the same reason: three checks give the exact cause, so there is no need to reset browser settings at random.

The guide does not fit two cases. If the proxy is set by an organization policy, Chrome settings show the label Chrome is using proxy settings from your administrator, and only the network administrator can change the address. If the website itself returns a 502 Proxy Error page, that is a reverse proxy failing on the site’s server, and local settings will not fix it.

What “cannot establish proxy connection” means: three different failures

A connection through a proxy goes through three stages, and each one can fail. First the browser opens a TCP connection to the proxy. Then it asks the proxy to build a tunnel to the site: a CONNECT request for an HTTP proxy, a handshake for SOCKS. Only after that does site data flow. Chrome calls a failure at the first stage ERR_PROXY_CONNECTION_FAILED, a refused tunnel ERR_TUNNEL_CONNECTION_FAILED, and a failed SOCKS handshake ERR_SOCKS_CONNECTION_FAILED.

How to fix a proxy connection error: 8 steps

Step 1. Read the error code on the browser page

1.         Open the tab with the error and keep it open.

2.         In Chrome and Edge, find the grey line in capital letters under the error text. In Firefox, read the page heading.

3.         Find your line in the table and note the next step.

ERR_PROXY_CONNECTION_FAILED: the proxy port did not accept the connection (Chromium 141, Linux).

ERR_TUNNEL_CONNECTION_FAILED: the proxy answered 403 to CONNECT, and the page never mentions a proxy.

You end up with one code or one Firefox heading from the table, and it decides the next step.

The ERR_TUNNEL_CONNECTION_FAILED page in Chrome does not contain the word proxy, which is misleading. On a test proxy that answered 403 Forbidden I got the generic text The webpage at https://example.com/ might be temporarily down. Firefox, judging by its source code, reports a proxy refusal in the same situation. I did not capture the page texts in Edge: go by the code, which is shared by all Chromium-based browsers.

Step 2. Find out what set the proxy for the browser

The proxy reaches the browser from an extension, the system or an organization policy. Chrome settings show which one.

1.         In Chrome, open chrome://settings/system.

2.         Read the bottom line of the System section. The label Chrome is using proxy settings from an extension means an extension sets the proxy: go to step 3.

3.         If the line reads Open your computer’s proxy settings, click it.

4.         On Windows 10 and 11 this opens Settings > Network & internet > Proxy. Check three blocks: Automatically detect settings, Use setup script and Use a proxy server.

5.         On macOS, open Apple menu > System Settings > Network, select the network service, click Details and go to the Proxies tab.

The line Open your computer’s proxy settings in chrome://settings/system.

The Details button on the error page expands a hint on where to look for proxy settings (Chromium 141 text on Linux).

You now know the proxy host, port and protocol, and where the setting comes from: an extension, the system or a policy.

A VPN connection in Windows has its own proxy field, and it is easy to miss. According to Microsoft’s help page, it sits under Settings > Network & internet > VPN > the connection > Advanced options > Proxy settings for this VPN connection. The general Proxy section can be empty at the same time.

Step 3. Turn off conflicting VPN extensions and apps

Do this step if step 2 showed that an extension sets the proxy. If you entered the proxy yourself, skip it.

1.         Turn off the VPN in the desktop app of the same service if it runs alongside the extension.

2.         Open chrome://extensions and temporarily switch off the other extensions that control the proxy or filter traffic: other VPNs, ad blockers, proxy switchers.

3.         Sign out of your account in the VPN extension and sign in again.

4.         Pick a different server in the extension and reload the page.

If a conflict was the cause, the page opens and the error code from step 1 is gone.

Running the app and the extension of one VPN at the same time can cause the failure. Two connections of the same service can get in each other’s way, so disconnect the app first and then turn on the extension. The extension hides the server address, so steps 4–7 do not apply to it: if the error comes back, write to the VPN service’s support. The order of checks for the VeePN extension is covered in a separate section below.

Step 4. Test the proxy outside the browser with curl

The command runs in a terminal and shows the proxy’s answer without the browser in between.

1.         Open a terminal. In Windows PowerShell type curl.exe: without the extension PowerShell runs its own built-in command with a different syntax.

2.         Run the command with your own details:

             curl -v --max-time 30 -x http://LOGIN:PASSWORD@HOST:PORT https://example.com/

3.         For SOCKS5, change the scheme to socks5h://.

4.         Write an @ in the password as %40: curl decodes the login and password from the URL.

5.         Find the last line of the output and match it against the table.

curl 8.22.0 against five test proxies: exit codes 7, 7, 97, 97 and 28.

Without a terminal, the Proxys.io online proxy checker runs the same test. Enter the details on one line in the format IP:port:login:password and click Check proxy. The check takes 5–10 seconds. The checker connects to the proxy from its own server, so your firewall does not affect the result. If the checker reports a working proxy while curl on your computer returns an error, the cause is in your network: go to step 5.

The command returns either the HTML of the example.com page or a curl: (N) line with a number from the table.

The number in brackets depends on the curl version. The same proxy answering 403 gave me code 56 in curl 8.5.0 and code 7 in curl 8.22.0. The behavior changed in version 8.20.0, released on April 29, 2026, so read the message text and not only the number.

curl 8.5.0 against the same proxies: a refused tunnel returns code 56 where 8.22.0 returns 7.

Step 5. Check the address and port if the proxy does not accept the connection

This step covers ERR_PROXY_CONNECTION_FAILED, ERR_TIMED_OUT, the Firefox headings and curl codes 5, 7 and 28. You need the provider dashboard and a terminal.

1.         Compare the host and port in your settings with the ones issued in the provider dashboard. Copy them, do not retype them.

2.         Check that the port matches the selected protocol: a provider may issue different ports for HTTP and SOCKS5.

3.         Identify the type of failure with curl. Code 7 within a fraction of a second means nothing is listening on the port. Code 28 means the proxy does not answer: packets are filtered on the way or the server is overloaded.

4.         With code 28, check the firewall and antivirus using the proxy and firewall check guide.

5.         If the proxy is bound to your IP address, make sure the address did not change after you reconnected to the network or turned on a VPN.

ERR_TIMED_OUT: the proxy accepted the connection and did not answer, the page appeared after 30 seconds.

The step is done when the command from step 4 no longer returns codes 5, 7 or 28.

A special case is the address 127.0.0.1 in the proxy field. It points to a local program on your computer: a VPN client, an antivirus or a debugging proxy. Once that program is closed or uninstalled, nothing listens on the port, and Chrome shows ERR_PROXY_CONNECTION_FAILED on every site. Clear the field or start the program.

Step 6. Read the status the proxy returned to CONNECT

This step covers ERR_TUNNEL_CONNECTION_FAILED and the line CONNECT tunnel failed in the curl output.

1.         In the output of the command from step 4, find the line > CONNECT example.com:443 HTTP/1.1.

2.         Read the first line after it that starts with < HTTP/1.1.

3.         Act on the status from the list below.

• 403 Forbidden: the proxy forbids this tunnel. In the provider dashboard, check the IP binding and the list of allowed ports.
• 407 Proxy Authentication Required: the proxy did not accept the login or password. Copy them again.
• 502, 503 or 504: a failure on the proxy side. Repeat the request in a few minutes, change the IP or write to the provider.

curl -v shows the CONNECT request and the proxy’s response HTTP/1.1 403 Forbidden.

Once the cause is fixed, the curl output shows status 200 after CONNECT, and the page opens in the browser.

There is no point looking for the cause of a refused tunnel in the browser. Chrome deliberately hides the body of the proxy’s response to CONNECT, so that a proxy cannot pass itself off as the site. The Chromium source code says: We have seen proxy 403, 404, and 501 response bodies that contain a useful error message. A refusal for a non-standard port is legitimate, too: RFC 9110 recommends that proxies restrict CONNECT to known ports.

The same proxy with an http:// address: without a tunnel, the proxy’s refusal text is visible right on the page.

Step 7. Switch a password-protected SOCKS5 proxy to HTTP in Chrome

This step covers ERR_SOCKS_CONNECTION_FAILED and curl code 97.

1.         Confirm two things: the proxy requires a login and password, and the type selected in the settings is SOCKS5.

2.         Change the proxy type to HTTP or HTTPS for the same IP address.

3.         Check the port in the provider dashboard: if HTTP has its own port, put it in place of the SOCKS port.

4.         Open any site and enter the login and password in the Sign in window.

ERR_SOCKS_CONNECTION_FAILED: this is how both a refusing SOCKS5 proxy and a proxy that requires a password look.

Chrome shows a window with the text The proxy … requires a username and password, and the page loads after you enter the details.

Do not wait for Chrome to show a password window for SOCKS5. The Chromium documentation says: No authentication methods are supported for SOCKSv5 in Chrome. On a test SOCKS5 proxy that required a password I got the same page as for a refusal with a different cause: the two screenshots matched byte for byte.

Proxys.io proxies are issued with a login and password and work over HTTPS, HTTP and SOCKS, so for Chrome and Edge it is enough to pick the HTTP connection on the same address. Take one single-user foreign IPv4 proxy and run steps 4–7 on it.

Step 8. Clear Chrome’s list of bad proxies and retry

Do this in Chrome when curl already gets the page but the browser still shows the error.

1.         In Chrome, open chrome://net-internals/#proxy.

2.         Click Re-apply settings.

3.         Click Clear bad proxies. The page shows no confirmation.

4.         Go back to the tab with the error and reload it.

The Re-apply settings and Clear bad proxies buttons on the chrome://net-internals/#proxy page.

The page should now open through the proxy with no error code.

Testing the result right after the fix, without clearing the list, tells you nothing. Chrome marks a proxy it could not connect to as bad for 5 minutes and moves it to the end of the list, as the same Chromium proxy documentation describes. Firefox keeps that mark for 30 minutes: this is the value of the network.proxy.failover_timeout preference, 1800 seconds. A failed CONNECT tunnel does not put the proxy on the list.

Why a VPN causes the “cannot establish proxy connection” error

A browser VPN extension is technically a proxy. It controls the connection through the chrome.proxy interface and sends the browser’s requests to the VPN service’s server. When that server is unreachable or rejects the connection, Chrome reports the same codes as for an ordinary proxy, and the extension may show its own text on top. The error event carries a fatal flag: when it is set, the request is aborted and no direct connection is used.

A VPN app changes the network, and with it which proxies are reachable. An example from Mullvad’s help page: the service’s SOCKS5 proxy listens on address 10.64.0.1, port 1080, and is reachable only while the VPN connection is active. The help page warns that after the VPN is disconnected, programs set to use this proxy look as if they were blocking the internet. At that moment the browser reports a proxy refusal, although nobody changed the settings.

VeePN extension error “Cannot establish proxy connection”: what to check

In search, the message “Cannot establish proxy connection” is tied to the VeePN browser extension. VeePN’s help center does not contain the phrase itself: I checked three support articles updated in February and July 2026. It does say how the extension works. The VeePN article on connection issues states: Browser extensions function as proxies and do not support protocol changes. So a failure of the VeePN extension is a failed proxy connection: the browser did not get a working channel to a VeePN server.

VeePN’s help for Chrome, Edge and Firefox gives an order for restoring the connection in the extension. I added the server check from the neighbouring article:

1.         Log in to your VeePN account in the extension. The help center recommends this for both free and premium users.

2.         Disconnect the VPN in the VeePN desktop app, and only then connect through the extension. Running both creates a “double VPN” connection and causes errors.

3.         On chrome://extensions, temporarily turn off ad blockers, privacy or security extensions and other proxy extensions.

4.         Pick another server: first in the same country, then in a different one.

5.         Refresh the extension: open the browser’s Extensions page, find VeePN, open the extension menu and click Support, then Refresh Extension. If that does not help, reinstall the extension.

After these actions the VeePN extension connects to a server and sites open without an error code.

Two techniques from this guide do not apply to the VeePN extension. You cannot change the VPN protocol in it: according to VeePN’s help, that setting exists only in the apps for Windows, macOS, iOS and Android. Testing the server with curl from step 4 does not work either, because the extension does not show the address, port or password of its proxy. What remains is switching the server or the network.

IPv6 is a separate VeePN limitation. The help center says: VeePN currently does not support IPv6 connections. The service advises asking your internet provider whether the connection supports IPv4 and disabling IPv6 in the device or router settings. If the error remains after all checks, contact VeePN support through the link in the help article and attach the error code from step 1.

Frequently asked questions about proxy connection errors

What does “connection refused” mean when connecting to a proxy?

“Connection refused” means the computer at the proxy address answered, but no program is listening on the given port. In Windows program messages this is code 10061, which Microsoft describes as: No connection could be made because the target computer actively refused it. Code 10060 means something else: there was no answer at all. curl from step 4 tells the two cases apart: a refusal arrives within a fraction of a second with code 7, silence ends with code 28.

Why does the proxy error appear on a phone but not on a computer?

Chrome on a phone waits for the proxy a third as long as Chrome on a computer. In Chromium’s http_proxy_connect_job.cc file the tunnel timeout is 30 seconds for desktop and 10 seconds for Android and iOS. A slow proxy fits within the first value and misses the second. You can measure the proxy’s delay with the proxy ping guide.

Do I need to turn off the proxy to remove the error?

Turning the proxy off makes sense only if you did not set it up yourself. With a manually configured proxy, Chrome does not fall back to a direct connection: according to the Chromium documentation, every request through an unreachable proxy ends with ERR_PROXY_CONNECTION_FAILED. If you need the proxy for work, test it with curl or the online checker from step 4 and fix the cause with steps 5–7.

What to send to provider support if the error remains

Proxy provider support needs three things to find the cause without a long exchange. The first is the error code from step 1. The second is the output of curl -v from step 4 with the password replaced by asterisks. The third is a Chrome network log: open chrome://net-export/, click Start Logging to Disk, reproduce the error and stop the recording. The log shows the SOCKS reply number and the CONNECT status, which the error page hides.

Recording a network log on the chrome://net-export/ page: the Start Logging to Disk button.