function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
ItruItru 

Unable to tunnel through proxy. Proxy returns "HTTP/1.1 503 Service Unavailable

I'm trying to make an HTTP Request to other System.

They provided the endpoint URL which contains a Port number.

https://Test.com:50001/RESTAP/BGN/PRDV/CREATE

When I'm trying to make the request I facing with this ERROR:

> System.CalloutException: Unable to tunnel through proxy. Proxy returns
> "HTTP/1.1 503 Service Unavailable"

although I have added the URL in remote sites.

When I make the request from Postman - I get the response as expected.

My code is : 

    Http httpProtocol = new Http();
            HttpRequest request = new HttpRequest();
            String url = 'https://Test.com:50001/RESTAP/BGN/PRDV/CREATE';
            String username2 = 'Name';
            String password2 = 'Passowrd';
            Blob headerValue = Blob.valueOf(username2 + ':' + password2);
            String authorizationHeader = 'BASIC ' + EncodingUtil.base64Encode(headerValue);
            request.setEndpoint(url);
            request.setMethod('POST');
            request.setHeader('Authorization', authorizationHeader);
            request.setTimeout(60000);
    
    
            request.setHeader('Content-Type','application/json');
            request.setHeader('proxyPort','50001');
            request.setHeader('proxyHost','PROXYHOST URL');
            request.setHeader('proxySet','true');
    
            HttpResponse response = httpProtocol.send(request);


Note: The userName and Password will be filled from Custom setting.

I tried with and without the proxy header, I tried to turn the BASIC auth to Basic and many other little changes that didn't work.

I'm still getting this Error.

How can I know if it not blocked by Firewall? 

Any help or Idea to solve this issue

Thanks!
Best Answer chosen by Itru
Kunal Singh GusainKunal Singh Gusain
Hi Itru and John Wheeler,
salesforce IP addresses and your local IP addresses are two different addresses.
postman uses you PC's public IP addresses but while making callout from salesforce you need to whitelist salesforce instance IP addresses.
refer to this link Salesforce IP Addresses and Domains to Allow (https://help.salesforce.com/articleView?id=000321501&type=1&mode=1)

All Answers

prem jonnala 11prem jonnala 11
It could be the issue with the IP address, can you ask the webservice team to whitelist the salesforce IP address.
 
ItruItru
unfortunately, It's not about the Ip address, because I'm using postman - and I tried to use my internal network\ wifi public network and my mobile phone network.. all of them succeeded... 
jeev tearjeev tear
This might be because of IP address.
ItruItru
hi Jeev,
Can you please see my response to Prem above?
If you still think it about the IP can you please explain why It happens with Salesforce Ip but not with other IPs like Mobile Network/ Wifi Public Network and Internal Network.. all of them have different IP Address - and it works when I use postman...
Thanks!
Khan AnasKhan Anas (Salesforce Developers) 
Hi Itru,

Greetings to you!

This error happens if your firewall doesn’t allow access to your server where the web service is hosted. Making the firewall changes should fix this issue.

In general, when you see an issue, follow this checklist to troubleshoot the issue:
  • Make sure you have the firewall settings in your enterprise is configured to allow the inbound web service call.
  • Check whether the certificate is expired or not.
  • Check if your chain of trust has valid certificates.

Also, refer to this link: 
https://help.salesforce.com/articleView?id=000321501&type=1&mode=1 (https://help.salesforce.com/articleView?id=000321501&type=1&mode=1)

I hope it helps you.

Kindly let me know if it helps you and close your query by marking it as solved so that it can help others in the future. It will help to keep this community clean.

Thanks and Regards,
Khan Anas
John Wheeler 27John Wheeler 27
Has anyone got any updates on this issue? Unfortunately, the replies above regarding checking firewalls do not apply to me (or to the original poster by the looks of it).

My use case is connecting from Salesforce to an AWS Elastic Load Balancer, which is acting as the SSL terminator for the connection before forwarding on to an EC2 instance. I get the same "HTTP/1.1 503 Service Unavailable" error even though the call is logged in the AWS ELB logs, so it's not a firewall issue (AWS security group or network ACL).

We added the IP addresses of the AWS ELB into the SF whitelist, but this didn't fix the problem. (The AWS ELB has a DNS name to resolves to 2 IP addresses)

Like the OP, sending the identical request (HTTPS POST) via PostMan works without issue.

I suspect that Salesforce is making some specific check on the response that other clients do not, and this is why the request/response fails. Possibly the AWS ELB is responding from a different IP address to the request because the DNS name has 2 IP addresses? Is there any way to whitelist a DNS name rather than IP addresses?

Interestingly, we don't have this issue when sending HTTPS requests from SF to a VM behind a Cisco Netscaler LB. This behaves differently to the AWS ELB, but I don't know the details.

Any suggestions?

Thanks,

John
ManiKumar Gunda 10ManiKumar Gunda 10
hi John,
is there any update on this issue, since we are also facing the same issue

Thanks
manikumar
Kunal Singh GusainKunal Singh Gusain
Hi Itru and John Wheeler,
salesforce IP addresses and your local IP addresses are two different addresses.
postman uses you PC's public IP addresses but while making callout from salesforce you need to whitelist salesforce instance IP addresses.
refer to this link Salesforce IP Addresses and Domains to Allow (https://help.salesforce.com/articleView?id=000321501&type=1&mode=1)
This was selected as the best answer
ItruItru
Hi,
This question has been around for over a year - Sorry I did not update this.
Kunal Singh Gusain is right. When you got "HTTP/1.1 503 Service Unavailable" - your call did not reach the destination because of an internal service for example, so the destination system will need to whitelist your IP.


The issue with whitelisting:
Salesforce's recommendation is to whitelist ALL the IPs and not just your area which I guess will be like ~1M IP address.
The external service won't whitelist such a number (not even 200K for just one region) - They want only one IP Address which I guess is not possible.

Anyway, if it's possible to change the settings in their side and check the income request and manipulate it,
then, my suggestion is to share a key with a value in the header request and encrypt it with a symmetric key like AES256 and give up the whitelisting method, since Salesforce does not guarantee that the IPs will remain the same.

You can look more over here : 
https://salesforce.stackexchange.com/questions/272639/whitelisting-salesforce-ip-in-external-systems



unfortunately, I did some wrong tests trying to reach the service at that time so please ignore my first comments.
Victor Cazacu 4Victor Cazacu 4
Was anyone able to find the root cause for this error. I am getting the same error... everything works fine from postman but not from SFDC.
The IPs were whitelisted. The logs were checked on the external system and no requests were received from our SFDC instance. 
How did you resolve the issue in the end?