Fixing ERR_TUNNEL_CONNECTION_FAILED in Puppeteer

Here is the frustrating part: Chromium shows you none of this. Whether the gateway answered 403 or 465, Puppeteer reports the same ERR_TUNNEL_CONNECTION_FAILED. The real reason is in the status line, and to see it you have to take the browser out of the picture. That’s the first fix step below.

• A value the gateway can’t read
  ERR_TUNNEL_CONNECTION_FAILEDGateway sent 403. Two-letter country, city written together, sessions on the sticky port.
• Filters nobody matches
  ERR_TUNNEL_CONNECTION_FAILEDGateway sent 465. Drop the narrowest filter.
• Credentials in the proxy flag
  ERR_NO_SUPPORTED_PROXIESFlag gets host and port only.
• No page.authenticate()
  ERR_INVALID_AUTH_CREDENTIALSAuthenticate each page before goto().
• Wrong password
  Page loads with 407Copy both values again.
• https:// as proxy scheme
  ERR_PROXY_CONNECTION_FAILEDUse http://, also for HTTPS sites.
• socks5:// with a password
  ERR_SOCKS_CONNECTION_FAILEDChromium can’t; use the HTTP port.
• Wrong port
  ERR_PROXY_CONNECTION_FAILEDCopy host and port from the dashboard.
• http:// to the SOCKS5 port
  ERR_RESPONSE_HEADERS_TRUNCATEDUse the HTTP port, 9000 or 10000.
• Another gateway’s key (-cc-DE)
  Page loads, wrong countryUnknown keys are ignored. Write -country-de.
• No scheme at all
  WorksChromium assumes http://.

Puppeteer 25.12.0, Chrome 154, via.proxies.vision, October 14, 2026. The blue cards are the two causes above.

1. 1.Test the same login with curl

   curl prints the proxy’s status line, which Chromium hides.

   curl -sv -x http://via.proxies.vision:9000 \
     --proxy-user "USERNAME-country-de:PASSWORD" \
     https://ipinfo.io/json 2>&1 | grep "< HTTP"

   200 → proxy is fine403 / 465 → username407 → credentials

2. 2.Strip the username to the bare login

   Remove every targeting parameter and try again. If that works, the parameters are the problem. Copied -cc-US or -s-abc from another provider? Here it’s -country-us and -session-abc, and a key the gateway doesn’t know is ignored rather than refused, so check the exit’s country too.

3. 3.Add filters back one at a time

   An exit has to match every filter at once. Country alone almost always works; country, city and network together may match nothing right now. City names go in lower case without spaces or accents: newyork, saopaulo.

4. 4.Check the Puppeteer side

   Credentials only through page.authenticate(), called on every page before goto(). Scheme http://. Host and port exactly as in your dashboard (sessions need the sticky port), and bandwidth left on your plan.

const puppeteer = require("puppeteer");

const USER = process.env.PROXY_USER; // from your dashboard
const PASS = process.env.PROXY_PASS;

// Chromium remembers a proxy login per browser context, so one identity
// (one exit IP) per context. The sticky port pins the exit to the label.
async function newIdentity(browser, targeting = "", session = Math.random().toString(36).slice(2, 10)) {
  const context = await browser.createBrowserContext({ proxyServer: "http://via.proxies.vision:10000" });
  const page = await context.newPage();
  // Authenticate every page before its first navigation; no credentials in the proxy URL.
  await page.authenticate({ username: `${USER}${targeting}-session-${session}-lifetime-10`, password: PASS });
  return page;
}

(async () => {
  const browser = await puppeteer.launch();

  // Germany, a new IP for every identity
  const page = await newIdentity(browser, "-country-de");
  await page.goto("https://ipinfo.io/json");
  console.log(await page.evaluate(() => document.body.innerText));

  // The same IP for 10 minutes: the same session label, even in a new context
  const login = await newIdentity(browser, "-country-de", "checkout1");
  await login.goto("https://example.com/login");

  await browser.close();
})();

Building the targeting part by hand is where most of these errors start. The proxy generator in the dashboard writes valid usernames for you.