vscode-remote-release [Remote Tunnel] Cannot connect to tunnel though proxy because of socket hang up

VSCode Version:1.95.3
VS Code Remote Tunnel 1.5.2
Local OS Version: Windows 10
Remote OS Version: Debian 12
Remote Extension/Connection Type: Dev Containers/WSL/Remote - Tunnels/VS Code Server
Logs:

2025-01-16 14:38:04.754 15:50 16/01/2025[error] Error: socket hang up
	at re.from (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:940980)
	at w.<anonymous> (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:963273)
	at w.emit (node:events:531:35)
	at h.forEach.d.<computed> (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:680126)
	at ClientRequest.emit (node:events:519:28)
	at emitErrorEvent (node:_http_client:101:11)
	at Socket.socketOnEnd (node:_http_client:528:5)
	at Socket.emit (node:events:531:35)
	at endReadableNT (node:internal/streams/readable:1696:12)
	at process.processTicksAndRejections (node:internal/process/task_queues:82:21)
	at At.request (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:971833)
	at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
	at async E.axiosRequest (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:75388)
	at async E.request (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:76034)
	at async E.sendRequest (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:69974)
	at async E.listTunnels (c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:64683)
	at async c:\Users\username\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:1201977
	at async Y0.h (file:///c:/Users/username/Custom/app/vscode/VSCode-win32-x64-1.95.3/resources/app/out/vs/workbench/api/node/extensionHostProcess.js:114:32825)
	at async Promise.all (index 1)
	at async t.RemoteTreeDataProvider.refreshTunnels (c:\Users\username\.vscode\extensions\ms-vscode.remote-explorer-0.4.3\dist\node\extension.js:1:7783)
	at async Promise.all (index 0)

Steps to Reproduce:

install VS Code Remote Tunnel 2.configure in Windows env for the account http_proxy and https_proxy 3 follow VS Code Remote Tunnel doc about creating a tunnel through github.com

Note: we have a corporate proxy that does MTIM. Self-signed certificates are deployed at OS level.

Jan 16 '25 14:01 antoinetran

I also get these


2025-01-16 17:06:13.222 [info] ExtensionService#_doActivateExtension ms-vscode.remote-server, startup: false, activationEvent: 'onCommand:remote-tunnels.connectCurrentWindowToTunnel'
2025-01-16 17:06:16.673 [trace] [golang.go] INVOKE provider 'o=>o.provideHover(E.revive(r),i,s,n)'
2025-01-16 17:06:16.676 [trace] [golang.go] provider DONE after 3ms
2025-01-16 17:06:18.110 [debug] ProxyResolver#resolveProxy env http://ProxyIp:ProxyPort/https://global.rel.tunnels.api.visualstudio.com/tunnels?includePorts=true&labels=vscode-server-launcher&allLabels=true&global=true&api-version=2023-09-27-preview PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:18.111 [trace] ProxyResolver#net.connect [{"lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:18.140 [trace] [golang.go] INVOKE provider 'n=>n.provideDocumentHighlights(E.revive(r),i,s)'
2025-01-16 17:06:18.143 [trace] [golang.go] provider DONE after 2ms
2025-01-16 17:06:20.087 [trace] ExtHostCommands#executeCommand workbench.getCodeExchangeProxyEndpoints
2025-01-16 17:06:22.100 [debug] ProxyResolver#resolveProxy env https://mobile.events.data.microsoft.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:22.101 [trace] ProxyResolver#lookupProxyAuthorization callback proxyURL:http://ProxyIp:ProxyPort/ proxyAuthenticate:undefined proxyAuthenticateCache:undefined
2025-01-16 17:06:22.101 [trace] ProxyResolver#net.connect [{"ALPNProtocols":"http/1.1","lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:22.207 [trace] ProxyResolver#tls.connect [{"protocol":"https:","hostname":"mobile.events.d[32 chars]","method":"POST","headers":"[object Object]","agent":"[object Object]","_defaultAgent":"[object Object]","lookupProxyAuthorization":"[Function: bound d_]","noDelay":true,"servername":"mobile.events.d[32 chars]","secureEndpoint":true,"_vscodeAdditionalCaCerts":"[44 certs]","socket":"[object Object]"}]
2025-01-16 17:06:25.481 [trace] ExtHostCommands#executeCommand workbench.getCodeExchangeProxyEndpoints
2025-01-16 17:06:25.484 [debug] ProxyResolver#resolveProxy env https://github.com/login/oauth/access_token PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:25.484 [trace] ProxyResolver#lookupProxyAuthorization callback proxyURL:http://ProxyIp:ProxyPort/ proxyAuthenticate:undefined proxyAuthenticateCache:undefined
2025-01-16 17:06:25.484 [trace] ProxyResolver#net.connect [{"ALPNProtocols":"http/1.1","lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:25.525 [trace] ProxyResolver#tls.connect [{"protocol":"https:","slashes":true,"auth":"null","hostname":"github.com","hash":"null","search":"null","query":"null","pathname":"/login/oauth/access_token","href":"https://github.[43 chars]","method":"POST","headers":"[object Object]","agent":"[object Object]","_defaultAgent":"[object Object]","lookupProxyAuthorization":"[Function: bound d_]","noDelay":true,"servername":"github.com","secureEndpoint":true,"_vscodeAdditionalCaCerts":"[44 certs]","socket":"[object Object]"}]
2025-01-16 17:06:25.805 [debug] ProxyResolver#resolveProxy env https://api.github.com/user PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:25.805 [trace] ProxyResolver#lookupProxyAuthorization callback proxyURL:http://ProxyIp:ProxyPort/ proxyAuthenticate:undefined proxyAuthenticateCache:undefined
2025-01-16 17:06:25.805 [trace] ProxyResolver#net.connect [{"ALPNProtocols":"http/1.1","lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:25.851 [trace] ProxyResolver#tls.connect [{"protocol":"https:","slashes":true,"auth":"null","hostname":"api.github.com","hash":"null","search":"null","query":"null","pathname":"/user","href":"https://api.git[27 chars]","method":"GET","headers":"[object Object]","agent":"[object Object]","_defaultAgent":"[object Object]","lookupProxyAuthorization":"[Function: bound d_]","noDelay":true,"servername":"api.github.com","secureEndpoint":true,"_vscodeAdditionalCaCerts":"[44 certs]","socket":"[object Object]"}]
2025-01-16 17:06:26.176 [debug] ProxyResolver#resolveProxy env http://ProxyIp:ProxyPort/https://global.rel.tunnels.api.visualstudio.com/tunnels?includePorts=true&labels=vscode-server-launcher&allLabels=true&global=true&api-version=2023-09-27-preview PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:26.177 [trace] ProxyResolver#net.connect [{"lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:26.477 [trace] [golang.go] INVOKE provider 's=>s.provideCodeLenses(E.revive(r),i)'
2025-01-16 17:06:26.477 [trace] [golang.go] provider DONE after 1ms
2025-01-16 17:06:26.478 [trace] [golang.go] INVOKE provider 's=>s.provideCodeLenses(E.revive(r),i)'
2025-01-16 17:06:26.478 [trace] [vscode.merge-conflict] INVOKE provider 's=>s.provideCodeLenses(E.revive(r),i)'
2025-01-16 17:06:26.480 [trace] ExtHostCommands#executeCommand setContext
2025-01-16 17:06:26.480 [trace] ExtHostCommands#executeCommand _setContext
2025-01-16 17:06:26.480 [trace] [vscode.merge-conflict] provider DONE after 1ms
2025-01-16 17:06:26.481 [trace] [golang.go] provider DONE after 3ms
2025-01-16 17:06:28.196 [debug] ProxyResolver#resolveProxy env https://mobile.events.data.microsoft.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream PROXY ProxyIp:ProxyPort 
2025-01-16 17:06:28.196 [trace] ProxyResolver#lookupProxyAuthorization callback proxyURL:http://ProxyIp:ProxyPort/ proxyAuthenticate:undefined proxyAuthenticateCache:undefined
2025-01-16 17:06:28.196 [trace] ProxyResolver#net.connect [{"ALPNProtocols":"http/1.1","lookupProxyAuthorization":"[Function: bound d_]","host":"ProxyIp","port":ProxyPort}]
2025-01-16 17:06:28.303 [trace] ProxyResolver#tls.connect [{"protocol":"https:","hostname":"mobile.events.d[32 chars]","method":"POST","headers":"[object Object]","agent":"[object Object]","_defaultAgent":"[object Object]","lookupProxyAuthorization":"[Function: bound d_]","noDelay":true,"servername":"mobile.events.d[32 chars]","secureEndpoint":true,"_vscodeAdditionalCaCerts":"[44 certs]","socket":"[object Object]"}]

Jan 16 '25 16:01 antoinetran

The error trace is never the same, today I got

2025-01-16 23:23:09.794 [error] Error: Failed to establish a socket connection to proxies: ["PROXY ProxyIp:ProxyPort"]
	at _PacProxyAgent.<anonymous> (c:\Users\username\Custom\app\vscode\Microsoft VS Code\resources\app\node_modules\@vscode\proxy-agent\out\agent.js:132:19)
	at Generator.throw (<anonymous>)
	at rejected (c:\Users\username\Custom\app\vscode\Microsoft VS Code\resources\app\node_modules\@vscode\proxy-agent\out\agent.js:6:65)
	at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
2025-01-16 23:23:09.794 [error] Error: Failed to establish a socket connection to proxies: ["PROXY ProxyIp:ProxyPort"]
	at _PacProxyAgent.<anonymous> (c:\Users\username\Custom\app\vscode\Microsoft VS Code\resources\app\node_modules\@vscode\proxy-agent\out\agent.js:132:19)
	at Generator.throw (<anonymous>)
	at rejected (c:\Users\username\Custom\app\vscode\Microsoft VS Code\resources\app\node_modules\@vscode\proxy-agent\out\agent.js:6:65)
	at process.processTicksAndRejections (node:internal/process/task_queues:95:5

Jan 17 '25 09:01 antoinetran

Could you install the Network Proxy Test extension (https://marketplace.visualstudio.com/items?itemName=chrmarti.network-proxy-test) and check the output of F1 > Network Proxy Test: Test Connection in VS Code?

If you cannot install the extension through the Extensions viewlet in VS Code, you can use the Download Extension link on the above linked page and then install the downloaded VSIX with F1 > Extensions: Install VSIX....

Feb 04 '25 10:02 chrmarti

This issue has been closed automatically because it needs more information and has not had recent activity. See also our issue reporting guidelines.

Happy Coding!

Feb 11 '25 12:02 vs-code-engineering[bot]

Hi, please reopen this ticket. I need time to do the investigation!

Feb 11 '25 13:02 antoinetran

@chrmarti Here is the result:

Note: Make sure to replace all sensitive information with dummy values before sharing this output.

VS Code 1.96.4 (cd4ee3b1c348a13bafd8f9ad8060705f6d4b9cba)
Network Proxy Test 0.0.16
win32 10.0.19045 x64

Settings:
- http.proxyStrictSSL: false
  - globalValue: false

Environment variables:
http_proxy=http://ProxyHost:ProxyPort
https_proxy=http://ProxyHost:ProxyPort

DNS:
- Servers: DnsServer
- Result Order: ipv4first
- Auto Select Family: true
- Auto Select Family Attempt Timeout: 250
- Lookup: DnsServerLookup (3 ms)

Proxy:
- URL: http://ProxyHost:ProxyPort (0 ms)
- Connection: 200 Connection established (216 ms)

Sending GET request to https://www.nytimes.com...
Received response:
- Status: 200 OK
Certificate chain:
- Subject: nytimes.com
  Subject alt: DNS:nytimes.com, DNS:www.homedelivery.nytimes.com, DNS:*.api.dev.nytimes.com, DNS:*.api.nytimes.com, DNS:*.api.stg.nytimes.com, DNS:*.blogs.nytimes.com, DNS:*.blogs.stg.nytimes.com, DNS:*.dev.nyt.com, DNS:*.dev.nyt.net, DNS:*.dev.nytimes.com, DNS:*.newsdev.nyt.net, DNS:*.newsdev.nytimes.com, DNS:*.nyt.com, DNS:*.nyt.net, DNS:*.nytco.com, DNS:*.nytimes.com, DNS:*.payflow.sbx.nytimes.com, DNS:*.sbx.nytimes.com, DNS:*.stg.newsdev.nyt.net, DNS:*.stg.newsdev.nytimes.com, DNS:*.stg.nyt.com, DNS:*.stg.nyt.net, DNS:*.stg.nytimes.com, DNS:*.timestalks.com, DNS:nyt.com, DNS:nyt.net, DNS:nytco.com, DNS:timestalks.com, DNS:*.myaccount-preview.stg.nytimes.com
  Validity: Mar 27 00:00:00 2024 GMT - Mar 13 23:59:59 2025 GMT
  Fingerprint: A1:5A:62:D4:CB:C8:1B:7D:59:50:68:95:22:E7:AC:F6:31:F6:1E:10
- Subject: REDACTED_PROXY_SURF
  Subject alt: DNS:REDACTED_PROXY_SURF, DNS:REDACTED_PROXY_SURF, DNS:REDACTED_PROXY_SURF, DNS:REDACTED_PROXY_SURF, DNS:REDACTED_PROXY_SURF
  Validity: Jul 18 07:18:50 2024 GMT - Aug 11 07:18:50 2025 GMT
  Fingerprint: REDACTED_FINGERPRINT
- Subject: REDACTED_PROXY_SURF
  Validity: Sep 17 13:54:40 2018 GMT - Sep 17 13:54:40 2028 GMT
  Fingerprint: REDACTED_FINGERPRINT
- Subject: REDACTED_PROXY_SURF
  Validity: Sep 17 13:46:53 2018 GMT - Sep 17 13:46:53 2047 GMT
  Fingerprint: REDACTED_FINGERPRINT
  Self-signed
Local root certificates:
- Subject: REDACTED_MTIM_CERTIFICATE_SUBJECT
  Validity: Sep 17 13:46:53 2018 GMT - Sep 17 13:46:53 2047 GMT
  Fingerprint: REDACTED_FINGERPRINT
  Issuer: REDACTED_MTIM_CERTIFICATE_ISSUER

Sending GET request to https://www.nytimes.com using fetch from Electron...
Received response:
- Status: 200 OK

Sending GET request to https://www.nytimes.com using fetch from Node.js...
Received response:
- Status: 200 OK

Sending GET request to https://www.nytimes.com using fetch from Node.js (allow HTTP2)...
Received response:
- Status: 200 OK

We have MTIM Proxy, and its certificate in our OS.

Feb 11 '25 13:02 antoinetran

Hi @connor4312 @bamurtaugh , anyone can reopen the ticket please? A one week notice before automatic closure is a bit too fast ^^ thanks!

Feb 12 '25 09:02 antoinetran

@connor4312 Should this reconnect?

Feb 25 '25 15:02 chrmarti

We have reconnection in general remote - tunnels -- where do you think it's needed? Not super clear where / if that doens't work in this issue.

Feb 25 '25 16:02 connor4312

@connor4312 The Error: socket hang up seems to suggest that the connection was lost.

Feb 26 '25 10:02 chrmarti

@connor4312 The Error: socket hang up seems to suggest that the connection was lost.

I am not sure this is a network issue. The socket hang up is systematic. Almost like if proxy cut if off? But I tried tunnel in web browser and it works, and I saw the almost same HTTP request being done .

What would help maybe is to add more debug to the HTTP request being terminated from proxy, showing its headers so that I can reproduce it with curl maybe? But until now, the curl I did works.

Feb 27 '25 08:02 antoinetran

So many content i got and my phone we stuck and change to new content its to hard to decide what is accurate program lang and machine type i use it to focus study to write script and i record it to my self and share to other if i got success . until now almost 1 6 months to study and my knowledge is stuck to many content i got

Feb 27 '25 14:02 Ayukjhay

Hey @connor4312 @chrmarti, this issue might need further attention.

@antoinetran, you can help us out by closing this issue if the problem no longer exists, or adding more information.

Jun 28 '25 12:06 vs-code-engineering[bot]

Hey @connor4312 @chrmarti, this issue might need further attention.

@antoinetran, you can help us out by closing this issue if the problem no longer exists, or adding more information.

I would like to add more info, but I already provided the logs. If there is anything I could add (debug log), please tell me.

Jun 30 '25 08:06 antoinetran

I reproduced the issue. I spent a few hours trying to look in Chrome debugger what URL + port it does before getting connection closed, but I really don't understand the remote tunnel code. I still get logs in console like

ERR [LocalProcess0][resolveAuthority(tunnel,1)][1450ms] returned an error Error: Connection closed
    at Socket.<anonymous> (c:\Users\XXX\.vscode\extensions\ms-vscode.remote-server-1.5.2\dist\node\extension.js:2:895636)
    at Object.onceWrapper (node:events:633:26)
    at Socket.emit (node:events:530:35)
    at Pipe.<anonymous> (node:net:351:12)
log.ts:460   ERR CodeExpectedError: Connection closed
    at zyt.sb (abstractExtensionService.ts:697:9)
    at async zyt.rb (abstractExtensionService.ts:658:19)
    at async zyt.ec (nativeExtensionService.ts:374:22)
    at async async.ts:2026:5

Jul 07 '25 14:07 antoinetran

I could not see the network HTTP request in "network" tab, related to this "connection closed". I think somehow the proxy intercept the RPC call to the tunnel and blocks it, but if I don't know the info like URL, port, HTTP method, I can't unblock it.

Jul 07 '25 14:07 antoinetran