hashicorp/terraform · error

Error connecting to proxy: %s

Error message

Error connecting to proxy: %s

What it means

Raised in BastionConnectFunc when newHttpProxyConn(p, bAddr) fails, meaning the initial TCP/HTTP-CONNECT tunnel through the configured HTTP proxy to the bastion host could not be established. This is the proxy-layer connection failure before any SSH handshake occurs.

Source

Thrown at internal/communicator/ssh/communicator.go:846

	addr string,
	p *proxyInfo) func() (net.Conn, error) {
	return func() (net.Conn, error) {
		log.Printf("[DEBUG] Connecting to bastion: %s", bAddr)
		var bastion *ssh.Client
		var err error

		// Wrap connection to bastion server if proxy server is configured
		if p != nil {
			var pConn net.Conn
			var bConn ssh.Conn
			var bChans <-chan ssh.NewChannel
			var bReq <-chan *ssh.Request

			RegisterDialerType()
			pConn, err = newHttpProxyConn(p, bAddr)

			if err != nil {
				return nil, fmt.Errorf("Error connecting to proxy: %s", err)
			}

			bConn, bChans, bReq, err = ssh.NewClientConn(pConn, bAddr, bConf)

			if err != nil {
				return nil, fmt.Errorf("Error creating new client connection via proxy: %s", err)
			}

			bastion = ssh.NewClient(bConn, bChans, bReq)
		} else {
			bastion, err = ssh.Dial(bProto, bAddr, bConf)
		}

		if err != nil {
			return nil, fmt.Errorf("Error connecting to bastion: %s", err)
		}

		log.Printf("[DEBUG] Connecting via bastion (%s) to host: %s", bAddr, addr)

View on GitHub (pinned to c9def3e214)

Solutions

1. Verify proxy_host and proxy_port are correct and the proxy is reachable (curl -x http://proxy:port bastion:22).
2. Check proxy_user_name and proxy_user_password are correct if the proxy requires auth.
3. Confirm the proxy server can route to the bastion host address.
4. Ensure no firewall or security group blocks the terraform runner to the proxy.

Example fix

// before
connection {
  bastion_host = var.bastion
  proxy_host   = var.proxy
  proxy_port   = 8080
}

// after
connection {
  bastion_host     = var.bastion
  proxy_host       = var.proxy
  proxy_port       = 3128
  proxy_user_name  = var.proxy_user
  proxy_user_password = var.proxy_pass
}

// Validate proxy reachability before provisioning
func validateProxyReachability(proxyHost string, proxyPort uint16) error {
    conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", proxyHost, proxyPort), 5*time.Second)
    if err != nil {
        return fmt.Errorf("proxy %s:%d is not reachable: %w", proxyHost, proxyPort, err)
    }
    conn.Close()
    return nil
}

When it happens

Trigger: When both a bastion_host and proxy_host are configured, the communicator first dials the HTTP proxy and issues a CONNECT to the bastion address. This error fires if the proxy is unreachable, refuses the connection, or the CONNECT tunnel fails.

Common situations: Wrong proxy_host or proxy_port, the proxy server is down, a firewall blocks the proxy, proxy authentication is misconfigured (wrong proxy_user_name/proxy_user_password), or the proxy cannot reach the bastion host.

Related errors

• Error creating new client connection via proxy: %s
• Error connecting to bastion: %s
• Connection Error: StatusCode: %d
• operation timed out
• operation timed out

AI-assisted analysis of hashicorp/terraform@c9def3e214 (2026-08-07). Data as JSON: /api/errors/3fc5ca0bdd180651. Report an issue: GitHub.