Proxy/Firewall Blocking Outbound Traffic in CI

By Daniel Zoghalchali·Latchkey

Outbound traffic from the runner is being blocked by a proxy or firewall, so requests are refused, time out, or return a proxy 403. This is a deterministic egress/config issue, not a transient blip.

What this error means

Requests to external hosts consistently fail (connection refused, timeout, or a proxy 403 Forbidden), while the same hosts work elsewhere. It fails every run until the egress path is fixed.

curl: (7) Failed to connect to example.com port 443: Connection refused
# or via proxy
HTTP/1.1 403 Forbidden (proxy)

Common causes

An egress proxy or firewall denies the host

Corporate or VPC egress controls block outbound destinations not on an allowlist; this fails consistently.

Missing proxy configuration

Tools that ignore HTTP(S)_PROXY env (or need their own proxy config) cannot reach anything through the required proxy.

How to fix it

Configure proxy environment variables

Point clients at the required proxy and set no_proxy for internal hosts.

export HTTPS_PROXY="http://proxy.internal:3128"
export HTTP_PROXY="http://proxy.internal:3128"
export NO_PROXY="localhost,127.0.0.1,.internal"

Allowlist the destinations

1. Add the registries/hosts your build needs to the egress allowlist.
2. Configure per-tool proxy settings (npm, pip, git, docker) where env vars are not honored.
3. Confirm the egress path with a direct test (curl -v).

How to prevent it

• Document and allowlist required egress hosts.
• Set proxy env consistently in CI.
• A retry will not help a hard egress block; fix the proxy/firewall config instead. Larger or managed runners do not bypass your network policy.

Frequently asked questions

Related guides

References

• GitHub Actions documentation