# Exec pomerium-cli proxy got 421 error

**URL:** <https://discuss.pomerium.com/t/exec-pomerium-cli-proxy-got-421-error/132>\
**Category:** Support\
**Created:** [June 22, 2022, 12:02pm UTC](https://discuss.pomerium.com/t/exec-pomerium-cli-proxy-got-421-error/132 "2022-06-22T12:02:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rogerw](https://avatars.discourse-cdn.com/v4/letter/r/3da27b/32.png) [@rogerw](https://discuss.pomerium.com/u/rogerw)\
**Post date:** [June 22, 2022, 12:02pm UTC](https://discuss.pomerium.com/t/exec-pomerium-cli-proxy-got-421-error/132/1 "2022-06-22T12:02:15Z")

</div>

## What happened?

i try use:pomerium-cli proxy --listen :22345 --proxy-domain [example.com](http://example.com)  
but i got a error: ERR Failed to run TCP tunnel error=“invalid http response code: 421”

the proxy log:  
{“level”:“info”,“service”:“envoy”,“upstream-cluster”:“”,“method”:“CONNECT”,“authority”:“[nginx-example.com:80](http://nginx-example.com:80)”,“path”:“”,“user-agent”:“Go-http-client/1.1”,“referer”:“”,“forwarded-for”:“10.244.0.0”,“request-id”:“12568ed3-3848-402f-9c00-314a50236c62”,“duration”:0.183781,“size”:0,“response-code”:421,“response-code-details”:“route\_not\_found”,“time”:“2022-06-22T19:56:22Z”,“message”:“http-request”}

## What did you expect to happen?

## How’d it happen?

1. pomerium-cli proxy --listen :22345 --proxy-domain [example.com](http://example.com)
2. export HTTPS\_PROXY=[http://127.0.0.1:22345](http://127.0.0.1:22345)
3. curl [https://example.com](https://example.com)  
4.saw error: ERR Failed to run TCP tunnel error=“invalid http response code: 421”

## What’s your environment like?

- Pomerium version (retrieve with `pomerium --version`):
- Server Operating System/Architecture/Cloud:

## What’s your config.yaml?

config:  
rootDomain: [trust.secchinatele.com](http://trust.secchinatele.com)  
existingCASecret: pomerium-tls

# insecure: true

generateTLS: false # On by default, disabled when cert-manager or another solution is in place.

# The policy block isn’t required when using the Pomerium Ingress Controller, as routes are defined

# by the addition of Ingress Resources.

routes:  
- from: [https://example.com](https://example.com)  
to: [http://nginx-app-svc:80](http://nginx-app-svc:80)  
pass\_identity\_headers: true  
policy:  
- allow:  
or:  
- domain:  
is: [example.com](http://example.com)

```auto
# Paste your configs here
# Be sure to scrub any sensitive values

```

## What did you see in the logs?

{“level”:“info”,“service”:“envoy”,“upstream-cluster”:“”,“method”:“CONNECT”,“authority”:“[nginx-example.com:80](http://nginx-example.com:80)”,“path”:“”,“user-agent”:“Go-http-client/1.1”,“referer”:“”,“forwarded-for”:“10.244.0.0”,“request-id”:“12568ed3-3848-402f-9c00-314a50236c62”,“duration”:0.183781,“size”:0,“response-code”:421,“response-code-details”:“route\_not\_found”,“time”:“2022-06-22T19:56:22Z”,“message”:“http-request”}

```logs
# Paste your logs here.
# Be sure to scrub any sensitive values

```

## Additional context

Add any other context about the problem here.

---

<div class="post-metadata">

**Author:** ![alex](https://yyz1.discourse-cdn.com/flex031/user_avatar/discuss.pomerium.com/alex/32/9_2.png) [@alex](https://discuss.pomerium.com/u/alex)\
**Post date:** [June 22, 2022, 9:43pm UTC](https://discuss.pomerium.com/t/exec-pomerium-cli-proxy-got-421-error/132/2 "2022-06-22T21:43:44Z")

</div>

Hi! The Pomerium CLI tool is only required (and only works) with TCP routes. That is to say, you only need if if you wanna tunnel and SSH, RDP, VNC, MySQl… etc connection through Pomerium.

For the route you provided, you should be able to just go to your `example.com` domain in the `from` field in your browser, and you’d be brought to your IdPs sign-in page.

---

<div class="post-metadata">

**Author:** ![rogerw](https://avatars.discourse-cdn.com/v4/letter/r/3da27b/32.png) [@rogerw](https://discuss.pomerium.com/u/rogerw)\
**Post date:** [June 23, 2022, 1:15am UTC](https://discuss.pomerium.com/t/exec-pomerium-cli-proxy-got-421-error/132/3 "2022-06-23T01:15:50Z")

</div>

thank for your help!  
i can exec pomerium-cli tcp command  
but exec pomerium-cli proxy allways got error  
can you tell me how to use pomerium-cli proxy command?  
about this info is too few