curl error codes when working through a proxy

What the error means

The number in curl: (N) is the exit code, the same as the libcurl error code. The libcurl documentation describes them like this: (5) CURLE_COULDNT_RESOLVE_PROXY - the given proxy host could not be resolved; (7) CURLE_COULDNT_CONNECT - failed to connect to the host or proxy; (28) CURLE_OPERATION_TIMEDOUT - the specified timeout period was reached.

(35) CURLE_SSL_CONNECT_ERROR - a problem occurred somewhere in the SSL/TLS handshake; (56) CURLE_RECV_ERROR - failure receiving network data; (97) CURLE_PROXY - proxy handshake error. For code 97 libcurl separately reports what exactly went wrong.

Codes 5, 7 and 28 usually mean the request never reached the proxy. Codes 56 and 97 mean there is a connection, but the program and the proxy did not agree. Code 35 most often concerns encryption between you and the site, not the proxy itself.

Causes

• (5) - the gateway name does not resolve. A typo in the host name, an extra character in the line or broken DNS on your network. The correct host is gw.prokso.com.
• (7) - the connection was refused. The gateway or the network on your side refused the connection: for example, a corporate firewall blocks outgoing traffic to non-standard ports.
• (28) - no answer in time. On ports outside 823, 824 and 10000-20000 the gateway does not answer at all, so curl waits until the timeout. A limit that is too short in -m or --connect-timeout ends the same way.
• (35) - TLS failure with the site. The TLS handshake with the site itself failed. Most often an antivirus or a corporate network intercepts encrypted connections and substitutes its own certificate.
• (56) and (97) - the protocol does not match the port or the login was rejected. curl exits with code 56 when an HTTP request goes to port 824 (SOCKS5), when the proxy address starts with https:// instead of http:// and when the gateway answered 407. A wrong username on SOCKS5 gives code 97 with the text User was rejected by the SOCKS5 server.

How to fix it

1. Run the command again with -v and find the last normal line. A step-by-step reading of the output is on the proxy troubleshooting page.
2. For (5) check the host: nslookup gw.prokso.com should return addresses. If it does not, the problem is your network's DNS or a typo.
3. For (7) and (28) check the port: 823 is HTTP, 824 is SOCKS5, 10000-20000 is a sticky IP. If the port is right, try another network, for example mobile internet. Long requests are covered on the proxy timeout page.
4. For (35) temporarily turn off HTTPS scanning in your antivirus or try from a network without traffic interception. More on the SSL certificate errors page.
5. For (56) and (97) match the scheme to the port: http:// (not https://) for HTTP, socks5h:// for 824 or sticky ports in SOCKS5 mode. Copy the username and password from the dashboard again; the parameter syntax is in the gateway reference.

How to check that it works

Run curl -x http://USERNAME:PASSWORD@gw.prokso.com:10000 https://prokso.com/ip. If you get JSON with an IP and a country, the proxy works and the exit code is 0. The last command's code is shown by echo $? on Linux and macOS or $LASTEXITCODE in PowerShell. Examples for different tasks are in the curl guide.

Two-minute diagnosis

First paste the line into the proxy checker. If the proxy works there, the cause is in your app or its settings. If not, test the line from a terminal:

curl -v -x "http://USERNAME:PASSWORD@gw.prokso.com:823" https://api.ipify.org

• A < HTTP/1.1 407 line right after CONNECT means the proxy answered. The name after the code, for example NO_USER, points to the cause.
• The proxy answered CONNECT with 200 and then another code arrived - the proxy works, and that answer came from the website.
• No answer at all, only a timeout - the connection never reached the proxy: check the host, port and network.

Setup guides where this error comes up

• Proxy setup in curl
• Proxy setup in wget