A tool says the proxy refused its tunnel

An https request from your box starts with a CONNECT to the Egress Proxy, which opens a tunnel to the host. When the proxy refuses the tunnel, most tools print only its status:

curl: (56) CONNECT tunnel failed, response 403

The same refusal reads differently elsewhere:

• older curl, and tools built on it: Received HTTP code 403 from proxy after CONNECT;
• git: fatal: unable to access '…': CONNECT tunnel failed, response 403;
• Python’s urllib, pip and requests: Tunnel connection failed: 403 Forbidden.

Find the code

The proxy’s answer names the refusal’s code, which the tool didn’t print. Ask again with curl’s -v, which prints the answer’s headers:

curl -v https://pastebin.com/raw/abc123

< HTTP/1.1 403 Forbidden
< link: <https://docs.awake.computer/errors/egress.not_allowed>; rel="help"
< proxy-status: awake-egress; error=http_request_denied; details="egress.not_allowed"

The code is in details, and its page says what to do. The commonest are:

• egress.not_allowed: no destination your box may reach covers the host;
• egress.needs_approval: the destination needs an approval first;
• egress.exception: one of your org’s exceptions refuses the host, whatever else allows it;
• egress.ip_literal: the request named an IP address instead of a host.

What you can do

Check the host’s name. If it’s the one you meant, ask for it in Requests where your org lets you, or ask your Awake admin, who sets your box’s destinations in Admin → Policies → Destinations.

For agents

Tell the person which host was refused, with the code. Don’t try another host, proxy, encoding or route to get around the refusal.