wget proxy authentication, and why HTTPS_PROXY is ignored
wget reads only the lowercase variable, and only the one for the URL's scheme. Get either wrong and it doesn't fail: it fetches the page from your own IP.
In short
For https:// URLs, wget uses https_proxy in lowercase and nothing else. Set it to http://via.proxies.vision:9000 and pass the login with --proxy-user and --proxy-password. Proxy tunneling failed: Proxy Authentication Required means that login was missing or wrong.
wget picks the proxy by the scheme of the URL you fetch: https_proxy for https://, http_proxy for http://. GNU wget reads these names in lowercase only. Many tools, curl included, also accept HTTPS_PROXY in capitals, so an environment that works for everything else can leave wget going direct. We set one variable at a time and compared the IP wget reached the site from with our own:
None of these printed a warning. The download succeeded, just not through the proxy. If it matters where a request comes from, check the IP once: wget -qO- https://ipinfo.io/ip through the proxy should not print your own address.
Login in the URL or in flags
http://USER:PASS@host:port in the variable works, but a password with @ in it breaks it: wget then tried to resolve ss@via.proxies.vision as the host. --proxy-user and --proxy-password (or proxy_user and proxy_password in ~/.wgetrc) need no escaping and keep the password out of the variable.
Every message, reproduced
GNU Wget 1.25.0 in Debian trixie against via.proxies.vision, https://ipinfo.io as the target.
| What we set | wget says | Exit |
|---|---|---|
| Wrong password, or no login | Proxy tunneling failed: Proxy Authentication RequiredUnable to establish SSL connection. | 4 |
| Wrong password, http:// URL | Proxy request sent, awaiting response... 407 Proxy Authentication Required | 8 |
Username -country-usa, or Chicago with country de | Proxy tunneling failed: …Unable to establish SSL connection. | 4 |
https_proxy=socks5h://… | Error parsing proxy URL socks5h://…: Unsupported scheme. | 8 |
| No scheme: USER:PASS@host:9000 | Error parsing proxy URL …: Scheme missing. | 8 |
| HTTP to the SOCKS port 11000 | Proxy tunneling failed: ?Unable to establish SSL connection. | 4 |
| Password with @, not encoded | unable to resolve host address 'ss@via.proxies.vision' | 4 |
wget hides the status code
For a refused tunnel, wget prints the proxy’s reason text and no number. On our gateway a username it can’t read (403) and filters no exit matches (465) each come with their own text, but you can’t tell the codes apart from wget’s output. Run the same login through curl -v -x http://via.proxies.vision:9000 -U USER:PASS https://ipinfo.io/ip once; curl prints the status. What each code means.
403 and 465
Targeting goes into the proxy username. 403 is a value the gateway can’t read, such as a three-letter country code or a session on the rotating port. 465 means no residential exit matches every filter right now: drop the narrowest one, usually the city.
No SOCKS in wget
GNU wget has no SOCKS support at all. Use our HTTP port 9000 with the same login, or switch to curl, which speaks SOCKS5: curl -x socks5h://via.proxies.vision:11000 -U USER:PASS https://ipinfo.io/ip.
Alpine images, and many other small containers, ship BusyBox’s wget, not GNU wget. It looks the same on the command line and behaves differently with proxies. We ran the same cases with BusyBox 1.37 in Alpine 3.22:
Install the real one
apk add wget replaced it with GNU Wget 1.25 in our test, and https_proxy then worked as described above. In a Dockerfile, apk add --no-cache wget before the first download. Or install curl, which handles HTTPS through a proxy in BusyBox images too.
A setup that works
Both ran unchanged with GNU Wget 1.25, with PROXY_USER and PROXY_PASS set in the shell.
# Flags: nothing to escape, the login never goes into a URL
wget -qO- \
-e use_proxy=yes \
-e https_proxy=http://via.proxies.vision:9000 \
-e http_proxy=http://via.proxies.vision:9000 \
--proxy-user="$PROXY_USER-country-de" \
--proxy-password="$PROXY_PASS" \
https://ipinfo.io/json{
"ip": "…",
"city": "Köln",
"country": "DE",
…use_proxy = on
https_proxy = http://via.proxies.vision:9000
http_proxy = http://via.proxies.vision:9000
proxy_user = USER-country-de
proxy_password = PASSA new IP per run
Each wget run opens a new connection, and port 9000 gives every connection a new exit. For the same IP across runs, add a session to the username and use port 10000: USER-country-de-session-job1-lifetime-10.
How do I use wget with a proxy that needs a username and password?
Why does wget ignore my HTTPS_PROXY variable?
What does 'Proxy tunneling failed: Proxy Authentication Required' mean?
Does wget support SOCKS5 proxies?
Why does wget in Alpine or BusyBox not use the proxy?
Keep reading
curl: (56) CONNECT tunnel failed, response 407 — and git's Proxy CONNECT aborted
What curl's 'CONNECT tunnel failed, response 407' means, every curl proxy exit code we hit, and why git fails through a proxy that works in curl.
6 min read · #errors#authentication
C# HttpClient Proxy Authentication: 407 With the Right Login
Why HttpClient gets 407 from a proxy with the correct login: WebProxy ignores user:pass in its address. Where the credentials go, SOCKS5, and errors.
5 min read · #errors#authentication
Java Proxy Authentication: 407 With the Right Password (disabledSchemes)
Why Java's HttpClient and HttpURLConnection get 407 from a proxy even with the correct login, and the one property that fixes it.
5 min read · #errors#authentication
Residential proxies, pay per GB
HTTP and SOCKS5. Country, city and sticky sessions in the username. No subscription.