Gateway errors
When the gateway refuses a connection it says why: in an `X-Reason` header on port 7000, in a SOCKS5 reply code on port 7001. Every answer is listed here with how your tool shows it and the fix.
The gateway or the site?
The gateway answers before a tunnel opens. On port 7000 its answer is the status line returned for CONNECT, or for a plain HTTP request, with an X-Reason header that names the cause. Anything that arrives after 200 Connection Established comes from the site. curl -v shows both:
$ curl -v -x gate.aeonproxy.com:7000 -U "LOGIN-cc-us-city-losangles:PASSWORD" https://api.ipify.org
< HTTP/1.1 407 Proxy Authentication Required
< Proxy-Authenticate: Basic realm="AeonProxy"
< X-Reason: unknown city
curl: (56) CONNECT tunnel failed, response 407Refused and failed connections never carry data through an exit, so they use no traffic.
HTTP port 7000
| Code | X-Reason | What it means | What to do |
|---|---|---|---|
| 407 | bad credentials | The login or the password is wrong. After Regenerate password the old password stops working at once, and a removed sub-user's login stops too | Copy both again from the dashboard |
| 407 | bad username | The login does not parse: a key that does not exist (-country- instead of -cc-), an uppercase key, a value with other characters than letters and digits (-sid-ab_12), a -ttl- that is not a whole number | Compare the login with the targeting syntax |
| 407 | login required | The request carried no login. Browsers, Java and .NET send their first request this way on purpose and repeat it with the login; it does not count as a failed login | If your tool stops here, enter the login and password in its proxy settings |
| 407 | unknown region, unknown city, unknown isp, unknown carrier | A value that is not in the lists | Take values from the dashboard or the locations API |
| 407 | region, city and isp need a country | -st-, -city-, -isp- or -car- without -cc- | Add the country key |
| 402 | traffic exhausted | No traffic left on this product. Residential and mobile traffic are separate | Add traffic on the product's page |
| 402 | sub-user limit reached | The sub-user used up its GB limit | Raise the limit in the Sub-users tab |
| 403 | mail port 587 is closed (or 25, 465, 2525) | Mail ports are closed for every account | None: mail cannot go through the gateway |
| 403 | government and military sites are blocked by default, banking and payment sites are blocked by default or ticketing sites are blocked by default | A target blocked by default | Another target, or an unlock after identity verification (default limits) |
| 403 | ends with closed on trial traffic | Only free trial traffic is left, and a port is closed for it | Buy traffic |
| 429 | too many failed logins | 30 failed logins within a minute from your IP address. Every login from it is refused until the minute is over, correct ones too | Fix the login, then wait a minute |
| 429 | starts with trial traffic: | The trial's limit on sessions at once or new connections per second | Fewer threads, or buy traffic |
| 400 | bad target or absolute URL expected | The tool sent a request the gateway cannot forward: a target without a valid host and port, or a request line without a full URL | Check the tool's proxy settings; tell support which tool it is if it keeps happening |
| 502 | A short technical note | The exit failed: it could not reach the target, refused it, or did not answer within 20 seconds | Retry. A rotating login takes a new exit; a sticky one keeps its key, so switch keys if it keeps failing |
| 503 | product not available, region list unavailable or city list unavailable | A temporary problem on our side | Retry later, and tell support if it lasts |
SOCKS5 port 7001
SOCKS5 has no room for a reason text, so its answers are shorter. This is how curl 8.5 shows them:
| What you see | What it means | What to do |
|---|---|---|
No authentication method was acceptable. | The client did not offer a login | Enter the login and password in the tool |
User was rejected by the SOCKS5 server (1 1). | Any refusal at login: wrong login or password, unknown key or value, no traffic left, the sub-user limit, or the failed-login limit | Run the same login through port 7000 with curl -v: its X-Reason says which |
Can't complete SOCKS5 connection to … (2) | A target blocked by default, a port closed on trial traffic, a trial limit, or a target the exit refused | Check the target and default limits |
The same message ending in (1) or (4) | The exit failed, or did not answer in time | Retry |
The same message ending in (5) | The connection was refused on the way to the target | Check the target's port, then retry |
The same message ending in (7) or (8) | A command the gateway does not support (BIND), or an address it cannot use | Use CONNECT or UDP ASSOCIATE, with a host name or a valid IP |
Connections that close
- Traffic ran out during a transfer. The gateway checks what is left while data flows and closes open connections when it reaches zero; new ones get 402. A sub-user's limit works the same way.
- No data for 10 minutes. A tunnel that is silent in both directions for 10 minutes is closed.
- Nothing sent for 30 seconds. A client that connects but sends no request is disconnected. This is also what a TLS or SOCKS5 greeting sent to port 7000 looks like from your side: a hang, then a closed connection.
- The exit went offline. Home connections and phones drop off now and then, and their open tunnels close with them. Reconnect: a rotating login takes a new exit, and a sticky key moves to a new IP.
When the site answers
A 403, a 429 or a CAPTCHA that arrives after the tunnel opened comes from the site, without our X-Reason. The usual causes are pace, headers and session handling, covered in why scrapers get blocked. The HTTP proxies guide goes through timeouts and certificate warnings.
Questions
No. They carry no data through an exit. Blocked targets and failed exits still count as requests in the Statistics tab of the product page and lower its Success rate.
Look at X-Reason. With the right password it is almost always the login: a misspelt key or value, or a tool that cut the login at a dash.