diff --git a/src/tuntap/conn.go b/src/tuntap/conn.go
index f303e0c3..d6bb7a7e 100644
--- a/src/tuntap/conn.go
+++ b/src/tuntap/conn.go
@@ -58,13 +58,18 @@ func (s *tunConn) reader() error {
 			// TODO don't start a new goroutine for every packet read, this is probably a big part of the slowdowns we saw when refactoring
 			if n, err = s.conn.Read(b); err != nil {
 				s.tun.log.Errorln(s.conn.String(), "TUN/TAP conn read error:", err)
+				if e, eok := err.(yggdrasil.ConnError); eok && !e.Temporary() {
+					close(s.stop)
+				} else {
+					read <- false
+				}
 				return
 			}
 			read <- true
 		}()
 		select {
-		case <-read:
-			if n > 0 {
+		case r := <-read:
+			if r && n > 0 {
 				bs := append(util.GetBytes(), b[:n]...)
 				select {
 				case s.tun.send <- bs:
diff --git a/src/yggdrasil/conn.go b/src/yggdrasil/conn.go
index 9175aa52..d2458db5 100644
--- a/src/yggdrasil/conn.go
+++ b/src/yggdrasil/conn.go
@@ -207,7 +207,7 @@ func (c *Conn) Read(b []byte) (int, error) {
 			defer close(done)
 			// If the nonce is bad then drop the packet and return an error
 			if !sinfo.nonceIsOK(&p.Nonce) {
-				err = errors.New("packet dropped due to invalid nonce")
+				err = ConnError{errors.New("packet dropped due to invalid nonce"), false, true, 0}
 				return
 			}
 			// Decrypt the packet