ERR_TUNNEL_CONNECTION_FAILED: What It Means & How to Fix It

What Is ERR_TUNNEL_CONNECTION_FAILED?

ERR_TUNNEL_CONNECTION_FAILED is a Chrome and Edge error that only happens when your browser is using a proxy server. Chromium's source describes net error -111 as: "A tunnel connection through the proxy could not be established." There's no dedicated error page for it, so you see the generic one: "This site can't be reached. The webpage at … might be temporarily down or it may have moved permanently to a new web address," with ERR_TUNNEL_CONNECTION_FAILED underneath.

That generic text is misleading. The website is usually fine. The failure happened one step earlier, between your browser and the proxy that's supposed to forward your traffic.

Many people who see this error have no idea they're using a proxy at all. A VPN app, a browser extension, an auto-config script on the network, or adware can quietly turn one on, so checking what proxy Chrome is actually using is the first step.

How a Proxy Tunnel Works (and Fails)

HTTPS traffic is encrypted end to end, so a regular web proxy can't read it. Instead, the browser asks the proxy to open a raw tunnel with a special request:

CONNECT example.com:443 HTTP/1.1
Host: example.com:443

HTTP/1.1 200 Connection established   <- tunnel open, HTTPS flows through it

HTTP/1.1 403 Forbidden                <- or the proxy refuses: ERR_TUNNEL_CONNECTION_FAILED

If the proxy answers with anything other than success, for example 403 because the site is blocked or 502 because the proxy itself can't reach the site, Chrome gives up and shows ERR_TUNNEL_CONNECTION_FAILED.

What Causes ERR_TUNNEL_CONNECTION_FAILED?

Fix 1: See Which Proxy Chrome Is Actually Using

Open chrome://net-internals/#proxy in the address bar, click Re-apply settings and Clear bad proxies, then reload the site. That page no longer lists the proxy itself. To see the effective proxy settings Chrome is using, including any auto-config script, save a log at chrome://net-export and open it in the NetLog viewer (netlog-viewer.appspot.com), under Proxy.

If it says "Use DIRECT connections" or shows no proxy, a proxy isn't the cause and you should check whether your network blocks the site instead. If it shows a proxy or a PAC script you don't recognise, continue with Fix 2 and Fix 3 to find out where it comes from. Opening What Is My IP also helps: if the location or ISP shown isn't yours, your traffic is going through a proxy or VPN.

Fix 2: Turn Off the System Proxy (If You Don't Use One)

Chrome and Edge use the operating system's proxy settings. If you don't use a proxy on purpose, switch it off:

• Windows 11: Settings → Network & internet → Proxy. Under Manual proxy setup, turn Use a proxy server off. Under Automatic proxy setup, leave Automatically detect settings on, but turn off Use setup script unless your organisation gave you one.

• macOS: System Settings → Network → your connection → Details… → Proxies. Turn off every proxy, including Automatic proxy configuration, unless you need it.

:: Windows also has a separate proxy for system services (WinHTTP)
netsh winhttp show proxy
netsh winhttp reset proxy

Fix 3: Check Extensions, VPN Apps and Chrome Policies

• Extensions: open chrome://settings/system. If an extension controls your proxy, Chrome shows a note saying that extension is controlling the setting, with a button to disable it. Otherwise, disable proxy and VPN extensions at chrome://extensions one at a time.

• VPN apps: some VPN apps work as a local proxy rather than a full VPN. Quit the app completely, not just disconnect, then reload.

• Policies: open chrome://policy. If you see proxy policies such as ProxyMode, ProxyServer or ProxyPacUrl, your organisation or installed software is enforcing a proxy, and you'll need to change it at the source (or ask IT).

Fix 4: Reset Network Settings and Flush DNS

If the proxy settings look clean but the error continues, reset the network configuration. In an administrator Command Prompt on Windows, run the commands below and restart; on a Mac, remove and re-add the network and flush the DNS cache.

ipconfig /flushdns
netsh winsock reset
netsh int ip reset
netsh winhttp reset proxy

Fix 5: On a Work or School Network, Ask Before You Bypass

Company and school networks often require a proxy, and many use it to block categories of websites. When only some sites fail with ERR_TUNNEL_CONNECTION_FAILED and everything else works, the proxy is very likely blocking those sites on purpose.

Turning the proxy off usually won't help on those networks, because direct connections are blocked too. Ask the IT team whether the site can be allowed, or use the site from another network.

For Proxy Administrators

To see exactly how the proxy answers the CONNECT request, reproduce it with curl from a client machine:

curl -v -x http://proxy.example.com:3128 https://example.com/ -o /dev/null
# Success:  "HTTP/1.1 200 Connection established"
# Failure:  "CONNECT tunnel failed, response 403"
#           (older curl: "Received HTTP code 403 from proxy after CONNECT")

A 403 points to an access rule, 407 to authentication, and 502/503 to the proxy failing to reach the destination (check the proxy's own DNS and outbound firewall). In Squid's default configuration, http_access deny CONNECT !SSL_ports refuses CONNECT to any port that isn't in the SSL_ports list (443 by default), so HTTPS sites on ports like 8443 fail until you add them. You can check from outside whether the destination port is reachable at all with DNS Robot's Port Checker.

ERR_TUNNEL_CONNECTION_FAILED vs Similar Errors

Related guides: ERR_CONNECTION_RESET, ERR_NETWORK_CHANGED and ERR_NAME_NOT_RESOLVED.