diff --git a/mitmproxy/connection.py b/mitmproxy/connection.py
index d38e23caf..f2d4c9cb5 100644
--- a/mitmproxy/connection.py
+++ b/mitmproxy/connection.py
@@ -291,12 +291,12 @@ class Server(Connection):
         return f"Server({human.format_address(self.address)}, state={self.state.name.lower()}{tls_state}{local_port})"
 
     def __setattr__(self, name, value):
-        if name == "address":
+        if name in ("address", "via"):
             connection_open = self.__dict__.get("state", ConnectionState.CLOSED) is ConnectionState.OPEN
             # assigning the current value is okay, that may be an artifact of calling .set_state().
-            address_changed = self.__dict__.get("address") != value
-            if connection_open and address_changed:
-                raise RuntimeError("Cannot change server address on open connection.")
+            attr_changed = self.__dict__.get(name) != value
+            if connection_open and attr_changed:
+                raise RuntimeError(f"Cannot change server.{name} on open connection.")
         return super().__setattr__(name, value)
 
     def get_state(self):
diff --git a/mitmproxy/proxy/layers/tls.py b/mitmproxy/proxy/layers/tls.py
index bf2cc32c6..47b813be1 100644
--- a/mitmproxy/proxy/layers/tls.py
+++ b/mitmproxy/proxy/layers/tls.py
@@ -177,6 +177,7 @@ class _TLSLayer(tunnel.TunnelLayer):
         if not tls_start.ssl_conn:
             yield commands.Log("No TLS context was provided, failing connection.", "error")
             yield commands.CloseConnection(self.conn)
+            return
         assert tls_start.ssl_conn
         self.tls = tls_start.ssl_conn
 
diff --git a/test/mitmproxy/proxy/layers/http/test_http.py b/test/mitmproxy/proxy/layers/http/test_http.py
index 9b53a75e7..4077b196c 100644
--- a/test/mitmproxy/proxy/layers/http/test_http.py
+++ b/test/mitmproxy/proxy/layers/http/test_http.py
@@ -706,10 +706,15 @@ def test_upstream_proxy(tctx, redirect, scheme):
 
     assert playbook
 
-    if redirect == "change-proxy":
-        assert server2().address == ("other-proxy", 1234)
+    if redirect == "change-destination":
+        assert flow().server_conn.address[0] == "other-server"
     else:
-        assert server2().address == ("proxy", 8080)
+        assert flow().server_conn.address[0] == "example.com"
+
+    if redirect == "change-proxy":
+        assert server2().address == flow().server_conn.via.address == ("other-proxy", 1234)
+    else:
+        assert server2().address == flow().server_conn.via.address == ("proxy", 8080)
 
     assert (
             playbook