Start your 3-day free trial
Sign up to experience all premium features at no cost.
*Available only to new users. Each user is limited to one trial.
NuGet Restore Failed: Check Feed and Download Connections
Kevin Wu
October 6, 2026· Updated October 7, 2026· 10 min read
When NuGet restore failed, start with the first error and the feed that generated it, then distinguish service discovery, package transfer, and authentication. Restore the same project with the same SDK and inputs; a browser opening a feed, or a later build succeeding from cache, cannot identify which connection failed.
Key Takeaways:
- NU1301 is a starting point for investigation, not proof that every failure is network-related.
- A service index can load while a package resource on another host remains unreachable.
- Preserve feed configuration, package versions, and any existing lock file during comparison.
- Confirm restore first; diagnose compilation and application behavior afterward.
Step 1: What must stay fixed when NuGet restore failed?
Identify the exact solution or project and how the restore was launched: Visual Studio, the .NET CLI, MSBuild, or another process. Record its working directory, SDK version, relevant project revision, and whether it uses PackageReference or an older package-management format. Different entrypoints can use different environments and supported options.［1］
The following command identifies the .NET CLI SDK selected in the current environment. Run it from the same directory as the failing CLI operation; a project SDK selection file can make another directory produce a different result.
dotnet --version
Preserve the project file, feed configuration, and existing package lock file before changing anything. Keep the original restore command and its switches in a private note. Do not remove the lock file, switch a package version, or upgrade the SDK during a connection comparison; those changes introduce a separate dependency experiment.
If every Windows application has connection trouble, consult the device and app troubleshooting branches first. This article concentrates on NuGet's requests and configuration. Use it only for projects and feeds you are authorized to access, with organization-managed settings reviewed by the responsible administrator.
Step 2: What does the first NuGet service index error show?
Read the earliest relevant error rather than copying only the final restore summary. Capture the code, sanitized feed identifier, failed operation, and nested message. Distinguish a name-resolution failure, connection timeout, certificate error, and HTTP authorization response before applying any remedy.
The V3 service index is a JSON document that advertises resources used by the client. Those resource URLs may use another hostname, so index access is only one stage in reaching package metadata and package content. An index successfully opened in a browser does not establish that all advertised resources are reachable from NuGet.［2］
| First observed failure | What it establishes | What to inspect next |
|---|---|---|
| Service index cannot be loaded | Discovery did not complete | Nested connection, TLS, or authorization error |
| Index loads, metadata request fails | One discovery endpoint worked | Advertised resource and affected package |
| Package content request times out | Restore reached the transfer stage | Exact content endpoint and network route |
| Feed returns 401 or 403 | A server or intermediary answered | Account, credential provider, and access policy |
| Version or source mapping is rejected | Requested dependency is not resolved as configured | Package identity, allowed sources, and project inputs |
| Restore succeeds but build fails | Download and build need separate conclusions | Compiler, target framework, or build tooling |
Keep the distinction between a missing response and an explicit denial. If an internal index redirects discovery toward a separate content service, give the administrator the sanitized host roles rather than requesting blanket network exceptions.
Avoid publishing complete diagnostic logs. Even when an error message masks a password, surrounding lines can contain private feed URLs, usernames, headers, or tokens. Store the original securely and share a small redacted excerpt with the people responsible for that environment.
Step 3: Which feed and credentials does this restore use?
Review the applicable NuGet.Config files locally, including repository and user configuration, and any explicit CLI arguments. Determine which sources are enabled, whether configuration clears inherited sources, and whether source mapping constrains a particular package. For dotnet restore, an explicit source argument can override configured feeds, so compare the actual command rather than only the config file you expected it to read.［3］
Do not add a mirror as the first action. Establish where the original package is meant to come from, who owns that source, and which authentication mechanism the client supports. A private feed may depend on an approved credential provider, an interactive account flow, or organization access that a browser session does not transfer to the CLI.
An IDE and a terminal can also differ in selected SDK, account state, environment variables, and working directory. Repeat the diagnosis with the same entrypoint that failed before comparing the other one. Preserve the distinction between an IDE credential problem and a general inability to download a package.
Check Windows proxy settings and their ownership if a stale personal proxy is suspected. Inspect only the relevant setting and keep credentials private; do not dump your entire process environment. If a required company proxy or TLS inspection certificate is involved, resolve its approved setup with the administrator instead of disabling trust checks.
A feed sign-in page is not a package-restore acceptance test. Confirm that your account can access the intended package and version using the supported client flow. Do not embed a token in the command line, replace the private feed with nuget.org, or use another person's credentials to bypass access control.
Step 4: How do you reproduce the original restore safely?
For a project already restored with the .NET CLI, repeat the same command in the same directory. The example below uses a placeholder project filename: replace it with your actual project and retain any original configuration, runtime, or source arguments. It restores packages and can update generated project files; it is not a read-only inspection.［3］
dotnet restore ./YourProject.csproj --verbosity minimal
If the existing workflow maintains packages.lock.json, preserve it and use its established locked-mode policy. The CLI supports --locked-mode to prevent dependency updates; do not add a new lock-file workflow during a network incident or claim that an absent lock file already pins the comparison.［3］
Stop if the repeated command now reports a changed dependency graph or incompatible project configuration. That needs the project maintainer, not repeated network changes. For older project formats or an MSBuild-based restore, use the matching documented entrypoint instead of assuming this CLI example applies unchanged.［1］
Before attributing a successful rerun to your connection, check whether any package actually needed downloading. A warm global package folder may allow restore to complete without testing the failed transfer. Prefer evidence from the previously missing package; do not clear the shared cache simply to make the command produce more network activity.
Any maintainer-approved isolated reproduction must preserve inputs and disclose its separate scope and cleanup needs.
Step 5: What if the NuGet package download failed on this route?
For a timeout reaching the original feed or package file, compare the Windows restore process against an authorized alternative path. With AethoVPN's official Windows installer, connect on the machine performing restore, select a suitable home-country or nearby position currently listed in the app, and turn on global mode before repeating that project's unchanged restore command. Watch whether the same service index and previously failing package request complete; the test does not supply private-feed permissions, correct missing versions, or bypass package-signature validation.
If you need an account for this comparison, create it with an email verification code; new users receive a 3-day free Pro trial once per user, without setting a password.
This Windows example does not mean NuGet only runs on Windows. For another supported local test machine, Linux installation is the Debian/Ubuntu x64 .deb, while Mac configuration comes from the website setup guide and requires Pro or Premium. Review Linux platform selection considerations rather than assuming another distribution or architecture is supported.
Keep the selected SDK, project, feeds, credentials, and package inputs identical across attempts. If the failure moves from a timeout to a 401, record improved reachability and unresolved authorization separately. A successful restore with the original sources is a stronger task result than an index opening in a browser, but cached packages still limit what it proves about transfer.
Use the tunnel checks before a NuGet restore only as supporting diagnostics. A remote runner, container, or cloud build executes requests elsewhere; establish its actual route independently. If the alternative connection has no effect, stop cycling locations and return to the source, trust, or authentication branch identified by the error.
Step 6: How do you verify recovery without changing the question?
Confirm the original project restores the expected packages from the permitted feeds, with lock-file behavior and integrity checks intact. Keep download evidence for the original failed package, then assess a normal build separately. A compiler or target-framework error after restore is a new stage, not evidence that the package connection remains broken.
Review configuration and project-file changes against the copies you preserved. Retain only a deliberate approved repair, remove temporary personal overrides, and ensure a source or package version was not silently substituted. Record cache use honestly if the successful command did not download the missing package.
When asking for help, include the SDK and client entrypoint, package identifier and version, sanitized source role, first error, and outcome of the fixed-input comparison. Keep private source URLs and credentials out of public tickets. If a Maven-based part of the same project also fails, trace Maven's repository and proxy selection separately; it uses another configuration system.
Summary
- Separate discovery, metadata, content transfer, and authorization.
- Preserve sources, package inputs, SDK selection, and existing locks.
- Compare the original package request, with cache use disclosed.
- Close restore before diagnosing compilation or application behavior.
FAQ
Is NU1301 always a network problem?
NU1301 identifies a failure loading the service index, but the nested error determines the cause. Check connection, TLS, and authorization evidence rather than assuming a VPN is the remedy for every occurrence.
Why does restore work in Visual Studio but fail in the CLI?
The IDE and CLI may use different SDKs, working directories, credentials, or process environments. Compare those inputs and the original failing entrypoint before concluding that the feed itself is unavailable.
Why can I open the index but not download packages?
The index advertises separate resources, potentially hosted elsewhere. The client still needs the relevant metadata and content endpoints, so successful index access does not establish that package transfer works.［2］
Can I replace a private feed with a public source?
Keep the private feed when the project requires its packages and permissions. Substituting a public source changes the test and can violate source policy; resolve authentication with the feed administrator instead.
Should I delete the package lock file?
Preserve an existing lock file and the project's restore policy. Deleting it allows a different dependency resolution, which makes the result unsuitable for a fixed-input connection comparison.
Should I clear all NuGet caches first?
Do not start by clearing shared caches. Determine whether the failed request is still needed, preserve evidence, and use a targeted maintainer-approved reproduction only when cache behavior prevents diagnosis.
Why does my build fail after restore succeeds?
Restore makes the dependencies available; compilation has additional framework, code, and tooling requirements. Record package recovery separately and investigate the first build error without repeating unnecessary network changes.
Disclaimer: Follow local law, service terms, and organization policy. These instructions apply to projects and feeds you own or are authorized to use and do not describe measured test results.
Cover attribution: NuGet logo, Microsoft / NuGet contributors; CC BY 2.0. The original logo is preserved, proportionally resized and positioned on a white canvas, then encoded as WebP. Its use identifies the article topic and does not imply endorsement.
Sources
- Microsoft Learn — NuGet Package Restore — https://learn.microsoft.com/en-us/nuget/consume-packages/package-restore
- Microsoft Learn — Service Index — https://learn.microsoft.com/en-us/nuget/api/service-index
- Microsoft Learn — dotnet restore — https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-restore
Sources checked 6 October 2026.
