diff --git a/src/java/org/apache/http/impl/client/DefaultClientRequestDirector.java b/src/java/org/apache/http/impl/client/DefaultClientRequestDirector.java
index 184190b16..5af9dd4cf 100644
--- a/src/java/org/apache/http/impl/client/DefaultClientRequestDirector.java
+++ b/src/java/org/apache/http/impl/client/DefaultClientRequestDirector.java
@@ -65,6 +65,7 @@ import org.apache.http.conn.HttpRoute;
 import org.apache.http.conn.ManagedClientConnection;
 import org.apache.http.conn.RouteDirector;
 import org.apache.http.conn.Scheme;
+import org.apache.http.entity.BufferedHttpEntity;
 import org.apache.http.message.BasicHttpRequest;
 import org.apache.http.params.HttpConnectionParams;
 import org.apache.http.params.HttpParams;
@@ -262,7 +263,15 @@ public class DefaultClientRequestDirector
                 if (managedConn == null || !managedConn.isOpen()) {
                     managedConn = allocateConnection(route);
                 }
-                establishRoute(route, context);
+                try {
+                    establishRoute(route, context);
+                } catch (TunnelRefusedException ex) {
+                    if (LOG.isDebugEnabled()) {
+                        LOG.debug(ex.getMessage());
+                    }
+                    response = ex.getResponse();
+                    break;
+                }
 
                 context.setAttribute(HttpExecutionContext.HTTP_TARGET_HOST,
                         roureq.getRoute().getTargetHost());
@@ -451,17 +460,24 @@ public class DefaultClientRequestDirector
         HttpRequest connect = createConnectRequest(route, context);
         //@@@ authenticate here, in method above, or in request interceptor?
 
-        HttpResponse connected =
+        HttpResponse response =
             requestExec.execute(connect, managedConn, context);
         managedConn.markReusable();
-        int status = connected.getStatusLine().getStatusCode();
-        //@@@ log something about the response?
+        int status = response.getStatusLine().getStatusCode();
 
-        //@@@ check for proxy authentication challenge, repeat with auth
+        if (status < 200) {
+            throw new HttpException("Unexpected response to CONNECT request: " +
+                    response.getStatusLine());
+        }
+        
+        // Buffer response
+        if (response.getEntity() != null) {
+            response.setEntity(new BufferedHttpEntity(response.getEntity()));
+        }
 
-        if ((status < 200) || (status > 299)) {
-            throw new HttpException("CONNECT refused by proxy: " +
-                                    connected.getStatusLine());
+        if (status > 299) {
+            throw new TunnelRefusedException("CONNECT refused by proxy: " +
+                    response.getStatusLine(), response);
         }
 
         // How to decide on security of the tunnelled connection?
diff --git a/src/java/org/apache/http/impl/client/TunnelRefusedException.java b/src/java/org/apache/http/impl/client/TunnelRefusedException.java
new file mode 100644
index 000000000..64ab0fa3e
--- /dev/null
+++ b/src/java/org/apache/http/impl/client/TunnelRefusedException.java
@@ -0,0 +1,52 @@
+/*
+ * $HeadURL$
+ * $Revision$
+ * $Date$
+ *
+ * ====================================================================
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ * ====================================================================
+ *
+ * This software consists of voluntary contributions made by many
+ * individuals on behalf of the Apache Software Foundation.  For more
+ * information on the Apache Software Foundation, please see
+ * <http://www.apache.org/>.
+ *
+ */
+
+package org.apache.http.impl.client;
+
+import org.apache.http.HttpException;
+import org.apache.http.HttpResponse;
+
+public class TunnelRefusedException extends HttpException {
+
+    private static final long serialVersionUID = -8646722842745617323L;
+
+    private final HttpResponse response;
+    
+    public TunnelRefusedException(final String message, final HttpResponse response) {
+        super(message);
+        this.response = response;
+    }
+
+    public HttpResponse getResponse() {
+        return this.response;
+    }
+
+}