{"record":{"id":"09c6f9389e470415","repo":"nats-io/nats-server","slug":"proxy-connect-failed-s","errorCode":null,"errorMessage":"proxy CONNECT failed: %s","messagePattern":"proxy CONNECT failed: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":667,"sourceCode":"\tif username != \"\" && password != \"\" {\n\t\treq.Header.Set(\"Proxy-Authorization\", \"Basic \"+base64.StdEncoding.EncodeToString([]byte(username+\":\"+password)))\n\t}\n\n\tif err := req.Write(conn); err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to write CONNECT request: %v\", err)\n\t}\n\n\tresp, err := http.ReadResponse(bufio.NewReader(conn), req)\n\tif err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to read proxy response: %v\", err)\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tresp.Body.Close()\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"proxy CONNECT failed: %s\", resp.Status)\n\t}\n\n\t// Close the response body\n\tresp.Body.Close()\n\n\t// Clear the deadline now that we've finished the proxy handshake\n\tif err := conn.SetDeadline(time.Time{}); err != nil {\n\t\tconn.Close()\n\t\treturn nil, fmt.Errorf(\"failed to clear deadline: %v\", err)\n\t}\n\n\treturn conn, nil\n}\n\n// Connect to a remote leaf node asynchronously (that is, this function will do\n// the connect in a go routine).\nfunc (s *Server) connectToRemoteLeafNodeAsynchronously(remote *leafNodeCfg, firstConnect bool) {\n\tremote.setConnectInProgress(true)","sourceCodeStart":649,"sourceCodeEnd":685,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L649-L685","documentation":"The proxy answered the CONNECT request with a non-200 status (e.g. 403 Forbidden, 407 Proxy Authentication Required, 502 Bad Gateway). The tunnel establishment is aborted with the proxy's own status line, so the NATS server cannot reach the target leafnode through the proxy.","triggerScenarios":"resp.StatusCode != http.StatusOK after http.ReadResponse in establishHTTPProxyTunnel: 407 means missing/wrong proxy credentials; 403 means the proxy forbids the target or source; 502/504 mean the proxy cannot reach the target host.","commonSituations":"Proxy requiring auth but no username/password configured (407); proxy ACLs blocking the destination host:port (403); target leafnode down or unreachable from the proxy (502/504); corporate proxies whitelisting only certain destinations.","solutions":["Add matching proxy username/password to the remote config if the status is 407","Check proxy ACLs/firewall rules to allow the target leafnode host:port (403)","Diagnose the proxy→target leg if the status is 502/504 (target down, DNS, egress rules)","Read the %s status string in the error to identify the exact proxy response"],"exampleFix":"// before\nproxy {\n  url: \"http://proxy:3128\"\n}\n// after (407 fix)\nproxy {\n  url: \"http://proxy:3128\"\n  username: \"user\"\n  password: \"pass\"\n}","handlingStrategy":"try-catch","validationCode":"// pre-flight: verify credentials and target reachability via proxy\ncurl -x http://user:pass@proxy:3128 https://leaf.example.com:443 -I","typeGuard":null,"tryCatchPattern":"_, err := establishHTTPProxyTunnel(purl, target, timeout, user, pass)\nif err != nil && strings.Contains(err.Error(), \"proxy CONNECT failed\") {\n    switch {\n    case strings.Contains(err.Error(), \"407\"):\n        log.Error(\"proxy needs credentials — set proxy username/password\")\n    case strings.Contains(err.Error(), \"403\"):\n        log.Error(\"proxy denies target — update proxy ACLs\")\n    default:\n        log.Errorf(\"proxy cannot reach target: %v\", err)\n    }\n}","preventionTips":["Configure proxy credentials whenever the proxy requires auth","Whitelist the leafnode host:port in proxy ACLs","Check the proxy can resolve and reach the target host","Parse the returned HTTP status in logs to drive remediation"],"tags":["network","proxy","http","authentication","acl"],"backgroundTag":"proxy-connect-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}