ERR_TUNNEL_CONNECTION_FAILED: What It Means & How to Fix It

What Is ERR_TUNNEL_CONNECTION_FAILED?

ERR_TUNNEL_CONNECTION_FAILED is a Chrome and Edge error that only happens when your browser is using a proxy server. Chromium's source describes net error -111 as: "A tunnel connection through the proxy could not be established" (net_error_list.h). There's no dedicated error page for it, so Chrome shows its generic one ("This site can't be reached. The webpage at … might be temporarily down or it may have moved permanently to a new web address") and Edge its own generic page, both with ERR_TUNNEL_CONNECTION_FAILED underneath.

That generic text is misleading. The website is usually fine. The failure happened at the proxy that's supposed to forward your traffic: Chrome reached it, but it refused or couldn't open the connection to the site.

Many people who see this error have no idea they're using a proxy at all. A VPN app, a browser extension, an auto-config script on the network, or adware can quietly turn one on, so checking what proxy Chrome is actually using is the first step.

How a Proxy Tunnel Works (and Fails)

HTTPS traffic is encrypted end to end, so a regular web proxy can't read it. Instead, the browser asks the proxy to open a raw tunnel with a special request:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443

HTTP/1.1 200 Connection established   <- tunnel open, HTTPS flows through it

HTTP/1.1 403 Forbidden                <- or the proxy refuses: ERR_TUNNEL_CONNECTION_FAILED

If the proxy answers with anything other than success, for example 403 because the site is blocked or 502 because the proxy itself can't reach the site, Chrome gives up and shows ERR_TUNNEL_CONNECTION_FAILED. The one exception is 407 (Proxy Authentication Required), which brings up a login prompt instead.

Chrome also throws away whatever the proxy sent back with its refusal, even a helpful block page, so that a fake proxy can't pretend to be the website (Chromium). That's why you get a generic error instead of your company's "site blocked" page; Squid, for example, answers a site whose name doesn't exist with a 503 error page that you never see.

What Causes ERR_TUNNEL_CONNECTION_FAILED?

Fix 1: See Which Proxy Chrome Is Actually Using

Open chrome://net-internals/#proxy in the address bar. It shows Chrome's Effective proxy settings, including any auto-config (PAC) script, with Re-apply settings and Clear bad proxies buttons: click both, then reload the site. For a full record of what happened to a failing request, save a log at chrome://net-export and open it in the NetLog viewer (netlog-viewer.appspot.com).

If it says "Use DIRECT connections" or shows no proxy, a proxy isn't the cause and you should check whether your network blocks the site instead. If it shows a proxy or a PAC script you don't recognise, continue with Fix 2 and Fix 3 to find out where it comes from. If What Is My IP loads, it also helps: if the location or ISP shown isn't yours, your traffic is going through a proxy or VPN.

Fix 2: Turn Off the System Proxy (If You Don't Use One)

Chrome and Edge use the operating system's proxy settings. If you don't use a proxy on purpose, switch it off (Windows also has a separate proxy for system services, WinHTTP, which the two commands below show and reset from an administrator Command Prompt):

• Windows 11: Settings → Network & internet → Proxy. Under Manual proxy setup, select Edit (or Set up) next to Use a proxy server, turn it off and select Save. Under Automatic proxy setup, turn off Use setup script (also under Edit) unless your organisation gave you one; if the error continues on that network, turn off Automatically detect settings too.
• macOS: System Settings → Network → your connection → Details… → Proxies. Turn off every proxy, including Automatic proxy configuration, unless you need it.

netsh winhttp show proxy
netsh winhttp reset proxy

Fix 3: Check Extensions, VPN Apps and Chrome Policies

• Extensions: open chrome://settings/system. If an extension controls your proxy, Chrome shows a note saying that extension is controlling the setting, with a button to disable it. Otherwise, disable proxy and VPN extensions at chrome://extensions one at a time.
• VPN apps: some VPN apps work as a local proxy rather than a full VPN. Quit the app completely, not just disconnect, then reload.
• Policies: open chrome://policy. If you see a proxy policy such as ProxySettings (or the older ProxyMode, ProxyServer or ProxyPacUrl), your organisation or installed software is enforcing a proxy, and you'll need to change it at the source (or ask IT).

Fix 4: Reset Network Settings and Flush DNS

If the proxy settings look clean but the error continues, reset the network configuration. In an administrator Command Prompt on Windows, run the commands below and restart; on a Mac, remove and re-add the network and flush the DNS cache.

ipconfig /flushdns
netsh winsock reset
netsh int ip reset
netsh winhttp reset proxy

Fix 5: On a Work or School Network, Ask Before You Bypass

Company and school networks often require a proxy, and many use it to block categories of websites. When only some sites fail with ERR_TUNNEL_CONNECTION_FAILED and everything else works, the proxy is very likely blocking those sites on purpose.

Turning the proxy off usually won't help on those networks, because direct connections are blocked too. Ask the IT team whether the site can be allowed, or use the site from another network.

For Proxy Administrators

To see exactly how the proxy answers the CONNECT request, reproduce it with curl from a client machine:

curl -v -x http://proxy.example.com:3128 https://example.com/ -o /dev/null
# Success:  "HTTP/1.1 200 Connection established"
# Failure:  "CONNECT tunnel failed, response 403"
#           (older curl: "Received HTTP code 403 from proxy after CONNECT")

A 403 points to an access rule, 407 to authentication, and 502/503 to the proxy failing to reach the destination (check the proxy's own DNS and outbound firewall). In Squid's default configuration (Squid), http_access deny CONNECT !SSL_ports refuses CONNECT to any port that isn't in the SSL_ports list (443 by default), so HTTPS sites on ports like 8443 fail until you add them. You can check from outside whether the destination port is reachable at all with DNS Robot's Port Checker.

ERR_TUNNEL_CONNECTION_FAILED vs Similar Errors

Related guides: ERR_CONNECTION_RESET, ERR_NETWORK_CHANGED and ERR_NAME_NOT_RESOLVED.