diff --git a/engine/common/net.h b/engine/common/net.h
index 5c877a937..23a4aea73 100644
--- a/engine/common/net.h
+++ b/engine/common/net.h
@@ -130,7 +130,7 @@ typedef enum
 
 extern	cvar_t	hostname;
 
-int TCP_OpenStream (netadr_t *remoteaddr);	//makes things easier
+int TCP_OpenStream (netadr_t *remoteaddr, const char *remotename);	//makes things easier. remotename is printable-only
 
 struct ftenet_connections_s;
 void		NET_Init (void);
diff --git a/engine/common/net_ice.c b/engine/common/net_ice.c
index 00c404439..412c19f35 100644
--- a/engine/common/net_ice.c
+++ b/engine/common/net_ice.c
@@ -2989,7 +2989,7 @@ static qboolean FTENET_ICE_GetPacket(ftenet_generic_connection_t *gcon)
 		const char *s;
 		if (b->timeout > realtime)
 			return false;
-		b->generic.thesocket = TCP_OpenStream(&b->brokeradr);	//save this for select.
+		b->generic.thesocket = TCP_OpenStream(&b->brokeradr, b->brokername);	//save this for select.
 		b->broker = FS_WrapTCPSocket(b->generic.thesocket, true, b->brokername);
 
 #ifdef HAVE_SSL
diff --git a/engine/common/net_wins.c b/engine/common/net_wins.c
index 5841d3ff3..b52dac180 100644
--- a/engine/common/net_wins.c
+++ b/engine/common/net_wins.c
@@ -6408,7 +6408,7 @@ ftenet_generic_connection_t *FTENET_TCP_EstablishConnection(ftenet_connections_t
 	}
 	else
 	{
-		newsocket = TCP_OpenStream(&adr);
+		newsocket = TCP_OpenStream(&adr, address);
 		if (newsocket == INVALID_SOCKET)
 		{
 			Z_Free(newcon);
@@ -8321,7 +8321,7 @@ void NET_PrintConnectionsStatus(ftenet_connections_t *collection)
 
 //=============================================================================
 
-int TCP_OpenStream (netadr_t *remoteaddr)
+int TCP_OpenStream (netadr_t *remoteaddr, const char *remotename)
 {
 #ifndef HAVE_TCP
 	return (int)INVALID_SOCKET;
@@ -8382,21 +8382,21 @@ int TCP_OpenStream (netadr_t *remoteaddr)
 		int err = neterrno();
 		if (err != NET_EWOULDBLOCK && err != NET_EINPROGRESS)
 		{
-			char buf[256];
-			NET_AdrToString(buf, sizeof(buf), remoteaddr);
 			if (err == NET_EADDRNOTAVAIL)
 			{
 				if (remoteaddr->port == 0 && (remoteaddr->type == NA_IP || remoteaddr->type == NA_IPV6))
-					Con_Printf ("TCP_OpenStream: no port specified (%s)\n", buf);
+					Con_Printf ("TCP_OpenStream: no port specified (%s)\n", remotename);
 				else
-					Con_Printf ("TCP_OpenStream: invalid address trying to connect to %s\n", buf);
+					Con_Printf ("TCP_OpenStream: invalid address trying to connect to %s\n", remotename);
 			}
 			else if (err == NET_ECONNREFUSED)
-				Con_Printf ("TCP_OpenStream: connection refused (%s)\n", buf);
+				Con_Printf ("TCP_OpenStream: connection refused (%s)\n", remotename);
 			else if (err == NET_EACCES)
-				Con_Printf ("TCP_OpenStream: access denied: check firewall (%s)\n", buf);
+				Con_Printf ("TCP_OpenStream: access denied: check firewall (%s)\n", remotename);
+			else if (err == NET_ENETUNREACH)
+				Con_Printf ("TCP_OpenStream: unreachable (%s)\n", remotename);
 			else
-				Con_Printf ("TCP_OpenStream: connect: error %i (%s)\n", err, buf);
+				Con_Printf ("TCP_OpenStream: connect: error %i (%s)\n", err, remotename);
 			closesocket(newsocket);
 			return (int)INVALID_SOCKET;
 		}
@@ -9510,7 +9510,7 @@ vfsfile_t *FS_OpenTCP(const char *name, int defaultport, qboolean assumetls)
 		if (wanttls)
 			return NULL;	//don't even make the connection if we can't satisfy it.
 #endif
-		f = FS_WrapTCPSocket(TCP_OpenStream(&adr), true, name);
+		f = FS_WrapTCPSocket(TCP_OpenStream(&adr, name), true, name);
 #ifdef HAVE_SSL
 		if (f && wanttls)
 			f = FS_OpenSSL(name, f, false);
diff --git a/engine/http/httpclient.c b/engine/http/httpclient.c
index 70eed1bde..0529543f2 100644
--- a/engine/http/httpclient.c
+++ b/engine/http/httpclient.c
@@ -1080,8 +1080,13 @@ void HTTPDL_Establish(struct dl_download *dl)
 		//fixme: support more than one address possibility?
 		//https uses a different default port
 		if (NET_StringToAdr2(con->server, https?443:80, &adr, 1, NULL))
-			con->sock = TCP_OpenStream(&adr);
+			con->sock = TCP_OpenStream(&adr, *dl->redir?dl->redir:dl->url);
 		con->stream = FS_WrapTCPSocket(con->sock, true, con->server);
+		if (!con->stream)
+		{
+			dl->status = DL_FAILED;
+			return;
+		}
 	}
 #ifdef HAVE_SSL
 	if (https)