diff --git a/server.go b/server.go
index 94af998..0389c26 100644
--- a/server.go
+++ b/server.go
@@ -13,6 +13,7 @@ import (
 // TODO: make configurable
 var keepAlivePeriod = time.Minute
 var retryConnectMinDelay = time.Minute
+var connectTimeout = 15 * time.Second
 var writeTimeout = 10 * time.Second
 
 func setKeepAlive(c net.Conn) error {
diff --git a/upstream.go b/upstream.go
index 2c430aa..8ad24c3 100644
--- a/upstream.go
+++ b/upstream.go
@@ -82,8 +82,10 @@ func connectToUpstream(network *network) (*upstreamConn, error) {
 		addr = addr + ":6697"
 	}
 
+	dialer := net.Dialer{Timeout: connectTimeout}
+
 	logger.Printf("connecting to TLS server at address %q", addr)
-	netConn, err := tls.Dial("tcp", addr, nil)
+	netConn, err := tls.DialWithDialer(&dialer, "tcp", addr, nil)
 	if err != nil {
 		return nil, fmt.Errorf("failed to dial %q: %v", addr, err)
 	}